https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Bug ID: 1372129 Summary: CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: jshepherd@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, alee@redhat.com, aszczucz@redhat.com, bazulay@redhat.com, bbaranow@redhat.com, bdawidow@redhat.com, bkearney@redhat.com, bmaxwell@redhat.com, bmcclain@redhat.com, cbillett@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, csutherl@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dblechte@redhat.com, dosoudil@redhat.com, eedri@redhat.com, epp-bugs@redhat.com, etirelli@redhat.com, felias@redhat.com, fnasser@redhat.com, gklein@redhat.com, gvarsami@redhat.com, hchiorea@redhat.com, hfnukal@redhat.com, huwang@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jboss-set@redhat.com, jbpapp-maint@redhat.com, jcoleman@redhat.com, jdg-bugs@redhat.com, jmatthew@redhat.com, jolee@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, katello-bugs@redhat.com, kconner@redhat.com, kseifried@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, lpetrovi@redhat.com, lsurette@redhat.com, mbaluch@redhat.com, mgoldboi@redhat.com, mgoldman@redhat.com, miburman@redhat.com, michal.skrivanek@redhat.com, mmccune@redhat.com, mweiler@redhat.com, mwinkler@redhat.com, myarboro@redhat.com, nwallace@redhat.com, ohadlevy@redhat.com, oourfali@redhat.com, pavelp@redhat.com, pgier@redhat.com, pkliczew@redhat.com, psakar@redhat.com, pslavice@redhat.com, puntogil@libero.it, rcernich@redhat.com, Rhev-m-bugs@redhat.com, rnetuka@redhat.com, rrajasek@redhat.com, rsvoboda@redhat.com, rwagner@redhat.com, rzhang@redhat.com, satellite6-bugs@redhat.com, sherold@redhat.com, soa-p-jira@post-office.corp.redhat.com, spinder@redhat.com, tcunning@redhat.com, theute@redhat.com, tjay@redhat.com, tkirby@redhat.com, tlestach@redhat.com, tomckay@redhat.com, tsanders@redhat.com, ttarrant@redhat.com, twalsh@redhat.com, vhalbert@redhat.com, vtunka@redhat.com, weli@redhat.com, ydary@redhat.com, ykaul@redhat.com
It was found that in some configurations the JacksonJsonpInterceptor is activated by default in RESTEasy. An attacker could use this flaw to launch a Cross Site Scripting Inclusion attack.
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
--- Comment #1 from Jason Shepherd jshepherd@redhat.com --- Acknowledgments:
Name: Mikhail Egorov (Odin)
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1371804
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1372130
--- Comment #2 from Jason Shepherd jshepherd@redhat.com ---
Created resteasy tracking bugs for this issue:
Affects: fedora-all [bug 1372130]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1372130 [Bug 1372130] CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1372141
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
--- Doc Text *updated* by Jason Shepherd jshepherd@redhat.com --- It was found that in some configurations the JacksonJsonpInterceptor is activated by default in RESTEasy. An attacker could use this flaw to launch a Cross Site Scripting Inclusion attack.
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1372565
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1372568
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1372571
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |lzap@redhat.com, | |mhulan@redhat.com, | |tbrisker@redhat.com Whiteboard|impact=low,public=20160901, |impact=low,public=20160901, |reported=20160829,source=re |reported=20160829,source=re |searcher,cvss2=2.6/AV:N/AC: |searcher,cvss2=2.6/AV:N/AC: |H/Au:N/C:P/I:N/A:N,cvss3=3. |H/Au:N/C:P/I:N/A:N,cvss3=3. |1/CVSS:3.0/AV:N/AC:H/PR:N/U |1/CVSS:3.0/AV:N/AC:H/PR:N/U |I:R/S:U/C:L/I:N/A:N,eap-7/R |I:R/S:U/C:L/I:N/A:N,eap-7/R |EST=wontfix,fedora-all/rest |EST=wontfix,fedora-all/rest |easy=affected,eap-6/RESTEas |easy=affected,eap-6/RESTEas |y=wontfix,eap-5/jbossas=won |y=wontfix,eap-5/jbossas=won |tfix,bpms-6/Build and |tfix,bpms-6/Build and |Assembly=wontfix,brms-6/Bui |Assembly=wontfix,brms-6/Bui |ld and |ld and |Assembly=wontfix,jdg-6/Buil |Assembly=wontfix,jdg-6/Buil |d=wontfix,jdv-6/Productizat |d=wontfix,jdv-6/Productizat |ion=wontfix,brms-5/Security |ion=wontfix,brms-5/Security |=wontfix,soap-5/Security=wo |=wontfix,soap-5/Security=wo |ntfix,fsw-6/SwitchYard=wont |ntfix,fsw-6/SwitchYard=wont |fix,fuse-6/SwitchYard=new,j |fix,fuse-6/SwitchYard=new,j |on-3/REST=wontfix,jpp-6/Req |on-3/REST=wontfix,jpp-6/Req |uirements=wontfix,rhsso-7/C |uirements=wontfix,rhsso-7/C |ore=wontfix,rhev-m-3/vdsm-j |ore=wontfix,rhev-m-3/vdsm-j |sonrpc-java=new,rhn_satelli |sonrpc-java=new,rhn_satelli |te_6/Security=new,sam-1/kat |te_6/Security=affected,sam- |ello=new |1/katello=new
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1471280, 1471279
--- Comment #4 from Kurt Seifried kseifried@redhat.com --- Created resteasy tracking bugs for this issue:
Affects: fedora-all [bug 1471279]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1471279 [Bug 1471279] CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160901, |impact=low,public=20160901, |reported=20160829,source=re |reported=20160829,source=re |searcher,cvss2=2.6/AV:N/AC: |searcher,cvss2=2.6/AV:N/AC: |H/Au:N/C:P/I:N/A:N,cvss3=3. |H/Au:N/C:P/I:N/A:N,cvss3=3. |1/CVSS:3.0/AV:N/AC:H/PR:N/U |1/CVSS:3.0/AV:N/AC:H/PR:N/U |I:R/S:U/C:L/I:N/A:N,eap-7/R |I:R/S:U/C:L/I:N/A:N,eap-7/R |EST=wontfix,fedora-all/rest |EST=wontfix,fedora-all/rest |easy=affected,eap-6/RESTEas |easy=affected,eap-6/RESTEas |y=wontfix,eap-5/jbossas=won |y=wontfix,eap-5/jbossas=won |tfix,bpms-6/Build and |tfix,bpms-6/Build and |Assembly=wontfix,brms-6/Bui |Assembly=wontfix,brms-6/Bui |ld and |ld and |Assembly=wontfix,jdg-6/Buil |Assembly=wontfix,jdg-6/Buil |d=wontfix,jdv-6/Productizat |d=wontfix,jdv-6/Productizat |ion=wontfix,brms-5/Security |ion=wontfix,brms-5/Security |=wontfix,soap-5/Security=wo |=wontfix,soap-5/Security=wo |ntfix,fsw-6/SwitchYard=wont |ntfix,fsw-6/SwitchYard=wont |fix,fuse-6/SwitchYard=new,j |fix,fuse-6/SwitchYard=new,j |on-3/REST=wontfix,jpp-6/Req |on-3/REST=wontfix,jpp-6/Req |uirements=wontfix,rhsso-7/C |uirements=wontfix,rhsso-7/C |ore=wontfix,rhev-m-3/vdsm-j |ore=wontfix,rhev-m-3/vdsm-j |sonrpc-java=new,rhn_satelli |sonrpc-java=new,rhn_satelli |te_6/Security=affected,sam- |te_6/Security=notaffected,s |1/katello=new |am-1/katello=new
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1481780
--- Comment #6 from Kurt Seifried kseifried@redhat.com --- Created resteasy tracking bugs for this issue:
Affects: fedora-all [bug 1481780]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1481780 [Bug 1481780] CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |drieden@redhat.com, | |pdrozd@redhat.com, | |sthorger@redhat.com Whiteboard|impact=low,public=20160901, |impact=low,public=20160901, |reported=20160829,source=re |reported=20160829,source=re |searcher,cvss2=2.6/AV:N/AC: |searcher,cvss2=2.6/AV:N/AC: |H/Au:N/C:P/I:N/A:N,cvss3=3. |H/Au:N/C:P/I:N/A:N,cvss3=3. |1/CVSS:3.0/AV:N/AC:H/PR:N/U |1/CVSS:3.0/AV:N/AC:H/PR:N/U |I:R/S:U/C:L/I:N/A:N,eap-7/R |I:R/S:U/C:L/I:N/A:N,eap-7/R |EST=wontfix,fedora-all/rest |EST=wontfix,fedora-all/rest |easy=affected,eap-6/RESTEas |easy=affected,eap-6/RESTEas |y=wontfix,eap-5/jbossas=won |y=wontfix,eap-5/jbossas=won |tfix,bpms-6/Build and |tfix,bpms-6/Build and |Assembly=wontfix,brms-6/Bui |Assembly=wontfix,brms-6/Bui |ld and |ld and |Assembly=wontfix,jdg-6/Buil |Assembly=wontfix,jdg-6/Buil |d=wontfix,jdv-6/Productizat |d=notaffected,jdv-6/Product |ion=wontfix,brms-5/Security |ization=wontfix,brms-5/Secu |=wontfix,soap-5/Security=wo |rity=wontfix,soap-5/Securit |ntfix,fsw-6/SwitchYard=wont |y=wontfix,fsw-6/SwitchYard= |fix,fuse-6/SwitchYard=new,j |wontfix,fuse-6/SwitchYard=n |on-3/REST=wontfix,jpp-6/Req |ew,jon-3/REST=wontfix,jpp-6 |uirements=wontfix,rhsso-7/C |/Requirements=notaffected,r |ore=wontfix,rhev-m-3/vdsm-j |hsso-7/Core=notaffected,rhe |sonrpc-java=new,rhn_satelli |v-m-3/vdsm-jsonrpc-java=new |te_6/Security=notaffected,s |,rhn_satellite_6/Security=n |am-1/katello=new |otaffected,sam-1/katello=ne | |w,jdg-7/resteasy=affected
java-sig-commits@lists.fedoraproject.org