https://bugzilla.redhat.com/show_bug.cgi?id=1448753
Bug ID: 1448753
Summary: SourceProvider in RestEasy-jaxrs is vulnerable to XXE
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: alee(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mgoldman(a)redhat.com, puntogil(a)libero.it,
weli(a)redhat.com
RESTEasy SourceProvider unmarshals some content without XML External Entity
protection. An attacker can use this flaw to launch an XXE attack on a RESTEasy
endpoint which uses a wildcard mime-type of mulitpart mime-type. Its only
possible to launch an attack if a mime-type of 'application/*+xml' is used
specifically.
--
You are receiving this mail because:
You are on the CC list for the bug.