CVE-2016-6345: Infoleak
It was found that there was insufficient use of randam values in RESTEasy async jobs. An attacker could use this flaw to steal user data.
Other sources
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6345?
CVE-2016-6345 has a medium severity rating due to its potential to expose sensitive user data.
How do I fix CVE-2016-6345?
To fix CVE-2016-6345, update to RESTEasy version 3.1.0 or higher if on version 3.1.x, or to version 3.0.20 if on version 3.0.x.
What types of software are affected by CVE-2016-6345?
CVE-2016-6345 affects RESTEasy versions prior to 3.1.0 and 3.0.20 from Red Hat.
What are the potential consequences of CVE-2016-6345?
Exploitation of CVE-2016-6345 could allow an attacker to access and steal sensitive user data.
Who is at risk for CVE-2016-6345?
Organizations using vulnerable versions of RESTEasy are at risk of data breaches due to CVE-2016-6345.