CVE-2016-6346: High severity redhat resteasy vulnerability
It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack.
Other sources
RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/resteasyto a version that resolves this vulnerability.Fixed in 3.1.0. - Upgrade
Upgrade
redhat/resteasyto a version that resolves this vulnerability.Fixed in 3.0.20. - Configuration
Disable GZIPInterceptor in RESTEasy when it is not required to prevent remote attackers from triggering a denial of service.
RESTEasy GZIPInterceptor = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6346?
CVE-2016-6346 is classified as a denial of service vulnerability.
How do I fix CVE-2016-6346?
To fix CVE-2016-6346, upgrade your RESTEasy package to version 3.1.0 or later, or to version 3.0.20 or later.
Which versions of RESTEasy are affected by CVE-2016-6346?
CVE-2016-6346 affects RESTEasy versions prior to 3.1.0 and versions prior to 3.0.20.
Can CVE-2016-6346 be exploited remotely?
Yes, CVE-2016-6346 can be exploited by remote attackers to launch a denial of service attack.
What components are vulnerable in CVE-2016-6346?
The vulnerability in CVE-2016-6346 is related to the GZIPInterceptor component in RESTEasy.