CVE-2020-25633: Medium severity redhat resteasy vulnerability

Published Sep 4, 2020
·
Updated

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information in headers, cookies and body when the server got WebApplicationException from the RESTEasy client call.

Other sources

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

A flaw was found in the RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. This flaw allows client users to obtain the server's potentially sensitive information when the server receives the WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to confidentiality.

Affected Software

64 affected componentsFixes available
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
0:3.2.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea
0:5.3.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea
0:4.5.13-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea
0:4.0.37-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms<0:2.0.8-1.Final_redhat_00001.1.el6ea
0:2.0.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-modules<0:1.11.0-1.Final_redhat_00001.1.el6ea
0:1.11.0-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.20-1.Final_redhat_00001.1.el6ea
0:5.0.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-4.Final_redhat_00005.1.el6ea
0:1.7.2-4.Final_redhat_00005.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.12-1.Final_redhat_00001.1.el6ea
0:3.7.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-narayana<0:5.9.10-1.Final_redhat_00001.1.el6ea
0:5.9.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-opentracing-interceptors<0:0.0.4.1-2.redhat_00002.1.el6ea
0:0.0.4.1-2.redhat_00002.1.el6ea
redhat/eap7-resteasy<0:3.11.3-1.Final_redhat_00001.1.el6ea
0:3.11.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.33-1.SP2_redhat_00001.1.el6ea
0:2.0.33-1.SP2_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.5-2.GA_redhat_00001.1.el6ea
0:7.3.5-2.GA_redhat_00001.1.el6ea
redhat/eap7-wildfly-discovery<0:1.2.1-1.Final_redhat_00001.1.el6ea
0:1.2.1-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.10-1.Final_redhat_00001.1.el6ea
0:1.10.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.24-1.Final_redhat_00001.1.el6ea
0:1.0.24-1.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el7ea
0:2.9.0-7.redhat_00017.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el7ea
0:2.3.9-12.SP13_redhat_00001.1.el7ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el7ea
0:3.2.12-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el7ea
0:5.3.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el7ea
0:4.5.13-1.redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el7ea
0:4.0.37-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms<0:2.0.8-1.Final_redhat_00001.1.el7ea
0:2.0.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-modules<0:1.11.0-1.Final_redhat_00001.1.el7ea
0:1.11.0-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.20-1.Final_redhat_00001.1.el7ea
0:5.0.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-4.Final_redhat_00005.1.el7ea
0:1.7.2-4.Final_redhat_00005.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.12-1.Final_redhat_00001.1.el7ea
0:3.7.12-1.Final_redhat_00001.1.el7ea
redhat/eap7-narayana<0:5.9.10-1.Final_redhat_00001.1.el7ea
0:5.9.10-1.Final_redhat_00001.1.el7ea
redhat/eap7-opentracing-interceptors<0:0.0.4.1-2.redhat_00002.1.el7ea
0:0.0.4.1-2.redhat_00002.1.el7ea
redhat/eap7-resteasy<0:3.11.3-1.Final_redhat_00001.1.el7ea
0:3.11.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.33-1.SP2_redhat_00001.1.el7ea
0:2.0.33-1.SP2_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.5-2.GA_redhat_00001.1.el7ea
0:7.3.5-2.GA_redhat_00001.1.el7ea
redhat/eap7-wildfly-discovery<0:1.2.1-1.Final_redhat_00001.1.el7ea
0:1.2.1-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.10-1.Final_redhat_00001.1.el7ea
0:1.10.10-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.24-1.Final_redhat_00001.1.el7ea
0:1.0.24-1.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el8ea
0:2.9.0-7.redhat_00017.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el8ea
0:2.3.9-12.SP13_redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el8ea
0:3.2.12-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el8ea
0:5.3.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el8ea
0:4.5.13-1.redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el8ea
0:4.0.37-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms<0:2.0.8-1.Final_redhat_00001.1.el8ea
0:2.0.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-modules<0:1.11.0-1.Final_redhat_00001.1.el8ea
0:1.11.0-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.20-1.Final_redhat_00001.1.el8ea
0:5.0.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-4.Final_redhat_00005.1.el8ea
0:1.7.2-4.Final_redhat_00005.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.12-1.Final_redhat_00001.1.el8ea
0:3.7.12-1.Final_redhat_00001.1.el8ea
redhat/eap7-narayana<0:5.9.10-1.Final_redhat_00001.1.el8ea
0:5.9.10-1.Final_redhat_00001.1.el8ea
redhat/eap7-opentracing-interceptors<0:0.0.4.1-2.redhat_00002.1.el8ea
0:0.0.4.1-2.redhat_00002.1.el8ea
redhat/eap7-resteasy<0:3.11.3-1.Final_redhat_00001.1.el8ea
0:3.11.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.33-1.SP2_redhat_00001.1.el8ea
0:2.0.33-1.SP2_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.5-2.GA_redhat_00001.1.el8ea
0:7.3.5-2.GA_redhat_00001.1.el8ea
redhat/eap7-wildfly-discovery<0:1.2.1-1.Final_redhat_00001.1.el8ea
0:1.2.1-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.10-1.Final_redhat_00001.1.el8ea
0:1.10.10-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.24-1.Final_redhat_00001.1.el8ea
0:1.0.24-1.Final_redhat_00001.1.el8ea
redhat/candlepin<0:3.1.26-1.el7
0:3.1.26-1.el7
redhat/resteasy<4.5.9.
4.5.9.
redhat resteasy<3.14.0
redhat resteasy>=4.5.0<=4.5.6
Quarkus Quarkus<=1.11.6
debian/resteasy<=3.6.2-3
debian/resteasy3.0<=3.0.26-2, <=3.0.26-6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-7.redhat_00017.1.el6ea
  2. Upgrade

    Upgrade redhat/eap7-glassfish-jsf to a version that resolves this vulnerability.

    Fixed in 0:2.3.9-12.SP13_redhat_00001.1.el6ea
  3. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.12-1.Final_redhat_00001.1.el6ea
  4. Upgrade

    Upgrade redhat/eap7-hibernate to a version that resolves this vulnerability.

    Fixed in 0:5.3.20-1.Final_redhat_00001.1.el6ea
  5. Upgrade

    Upgrade redhat/eap7-httpcomponents-client to a version that resolves this vulnerability.

    Fixed in 0:4.5.13-1.redhat_00001.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.37-1.Final_redhat_00001.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.8-1.Final_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-jboss-modules to a version that resolves this vulnerability.

    Fixed in 0:1.11.0-1.Final_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-1.Final_redhat_00001.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-4.Final_redhat_00005.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-jboss-xnio-base to a version that resolves this vulnerability.

    Fixed in 0:3.7.12-1.Final_redhat_00001.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.10-1.Final_redhat_00001.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-opentracing-interceptors to a version that resolves this vulnerability.

    Fixed in 0:0.0.4.1-2.redhat_00002.1.el6ea
  14. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.3-1.Final_redhat_00001.1.el6ea
  15. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.33-1.SP2_redhat_00001.1.el6ea
  16. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.5-2.GA_redhat_00001.1.el6ea
  17. Upgrade

    Upgrade redhat/eap7-wildfly-discovery to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-1.Final_redhat_00001.1.el6ea
  18. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.10-1.Final_redhat_00001.1.el6ea
  19. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.24-1.Final_redhat_00001.1.el6ea
  20. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-7.redhat_00017.1.el7ea
  21. Upgrade

    Upgrade redhat/eap7-glassfish-jsf to a version that resolves this vulnerability.

    Fixed in 0:2.3.9-12.SP13_redhat_00001.1.el7ea
  22. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.12-1.Final_redhat_00001.1.el7ea
  23. Upgrade

    Upgrade redhat/eap7-hibernate to a version that resolves this vulnerability.

    Fixed in 0:5.3.20-1.Final_redhat_00001.1.el7ea
  24. Upgrade

    Upgrade redhat/eap7-httpcomponents-client to a version that resolves this vulnerability.

    Fixed in 0:4.5.13-1.redhat_00001.1.el7ea
  25. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.37-1.Final_redhat_00001.1.el7ea
  26. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.8-1.Final_redhat_00001.1.el7ea
  27. Upgrade

    Upgrade redhat/eap7-jboss-modules to a version that resolves this vulnerability.

    Fixed in 0:1.11.0-1.Final_redhat_00001.1.el7ea
  28. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-1.Final_redhat_00001.1.el7ea
  29. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-4.Final_redhat_00005.1.el7ea
  30. Upgrade

    Upgrade redhat/eap7-jboss-xnio-base to a version that resolves this vulnerability.

    Fixed in 0:3.7.12-1.Final_redhat_00001.1.el7ea
  31. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.10-1.Final_redhat_00001.1.el7ea
  32. Upgrade

    Upgrade redhat/eap7-opentracing-interceptors to a version that resolves this vulnerability.

    Fixed in 0:0.0.4.1-2.redhat_00002.1.el7ea
  33. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.3-1.Final_redhat_00001.1.el7ea
  34. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.33-1.SP2_redhat_00001.1.el7ea
  35. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.5-2.GA_redhat_00001.1.el7ea
  36. Upgrade

    Upgrade redhat/eap7-wildfly-discovery to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-1.Final_redhat_00001.1.el7ea
  37. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.10-1.Final_redhat_00001.1.el7ea
  38. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.24-1.Final_redhat_00001.1.el7ea
  39. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-7.redhat_00017.1.el8ea
  40. Upgrade

    Upgrade redhat/eap7-glassfish-jsf to a version that resolves this vulnerability.

    Fixed in 0:2.3.9-12.SP13_redhat_00001.1.el8ea
  41. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.12-1.Final_redhat_00001.1.el8ea
  42. Upgrade

    Upgrade redhat/eap7-hibernate to a version that resolves this vulnerability.

    Fixed in 0:5.3.20-1.Final_redhat_00001.1.el8ea
  43. Upgrade

    Upgrade redhat/eap7-httpcomponents-client to a version that resolves this vulnerability.

    Fixed in 0:4.5.13-1.redhat_00001.1.el8ea
  44. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.37-1.Final_redhat_00001.1.el8ea
  45. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.8-1.Final_redhat_00001.1.el8ea
  46. Upgrade

    Upgrade redhat/eap7-jboss-modules to a version that resolves this vulnerability.

    Fixed in 0:1.11.0-1.Final_redhat_00001.1.el8ea
  47. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-1.Final_redhat_00001.1.el8ea
  48. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-4.Final_redhat_00005.1.el8ea
  49. Upgrade

    Upgrade redhat/eap7-jboss-xnio-base to a version that resolves this vulnerability.

    Fixed in 0:3.7.12-1.Final_redhat_00001.1.el8ea
  50. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.10-1.Final_redhat_00001.1.el8ea
  51. Upgrade

    Upgrade redhat/eap7-opentracing-interceptors to a version that resolves this vulnerability.

    Fixed in 0:0.0.4.1-2.redhat_00002.1.el8ea
  52. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.3-1.Final_redhat_00001.1.el8ea
  53. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.33-1.SP2_redhat_00001.1.el8ea
  54. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.5-2.GA_redhat_00001.1.el8ea
  55. Upgrade

    Upgrade redhat/eap7-wildfly-discovery to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-1.Final_redhat_00001.1.el8ea
  56. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.10-1.Final_redhat_00001.1.el8ea
  57. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.24-1.Final_redhat_00001.1.el8ea
  58. Upgrade

    Upgrade redhat/candlepin to a version that resolves this vulnerability.

    Fixed in 0:3.1.26-1.el7
  59. Upgrade

    Upgrade redhat/resteasy to a version that resolves this vulnerability.

    Fixed in 4.5.9.
  60. Upgrade

    Upgrade RESTEasy (client) to a version that resolves this vulnerability.

    Fixed in 4.5.6.Final
  61. Compensating control

    Review RESTEasy client usage that can trigger WebApplicationException and ensure server-side error handling does not return sensitive information from headers, cookies, or body to client users.

Event History

Sep 4, 2020
CVE Published
12:00 AM
Sep 15, 2020
Data Sourced
via Red Hat·10:03 AM
DescriptionSeverityAffected Software
Sep 18, 2020
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
DescriptionSeverityWeakness
Mar 13, 2025
Data Sourced
via Ubuntu·02:41 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·02:42 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-25633?

The severity of CVE-2020-25633 is classified as medium, indicating potential risk to sensitive information.

2

How do I fix CVE-2020-25633?

To fix CVE-2020-25633, upgrade to the appropriate versions of the affected packages as indicated by the vendor's advisory.

3

What versions are affected by CVE-2020-25633?

CVE-2020-25633 affects all versions of RESTEasy client up to and including 4.5.6.Final.

4

What kind of information could be exposed due to CVE-2020-25633?

CVE-2020-25633 may allow clients to obtain potentially sensitive information from server headers, cookies, and body responses.

5

Is there a workaround for CVE-2020-25633?

No official workaround is available for CVE-2020-25633; the recommended action is to update to the fixed versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203