CVE-2017-7561: High severity redhat JBoss Enterprise Application Platform vulnerability
Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
Other sources
Red Hat JBoss EAP version 3.0.7.Final until 3.0.25.Final, 3.5.0.CR1, and 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
— GitHub
The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Resteasy versions >=3.0.7 are affected because they include the CORS Filter.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jboss.resteasy:resteasy-jaxrsto a version that resolves this vulnerability.Fixed in 3.5.0.CR1 - Upgrade
Upgrade
maven/org.jboss.resteasy:resteasy-jaxrsto a version that resolves this vulnerability.Fixed in 3.0.25.Final - Upgrade
Upgrade
redhat/resteasyto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7561?
The severity of CVE-2017-7561 is considered moderate.
How do I fix CVE-2017-7561?
To fix CVE-2017-7561, upgrade to Red Hat JBoss EAP version 4.0.0 or later, or apply the appropriate patches for affected versions.
Which versions of Red Hat JBoss EAP are affected by CVE-2017-7561?
Affected versions include Red Hat JBoss EAP 3.0.7 Final through 3.0.25 Final and 3.5.0.CR1.
What component of Red Hat JBoss EAP is vulnerable in CVE-2017-7561?
The vulnerability in CVE-2017-7561 affects the JAX-RS component.
What type of attack can exploit CVE-2017-7561?
CVE-2017-7561 can be exploited for server-side cache poisoning or CORS requests.