https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Bug ID: 1942819 Summary: RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: jwon@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, alee@redhat.com, alexander.m.scheel@gmail.com, asoldano@redhat.com, atangrin@redhat.com, avibelli@redhat.com, bbaranow@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bgeorges@redhat.com, bibryam@redhat.com, bkearney@redhat.com, bmaxwell@redhat.com, brian.stansberry@redhat.com, btotty@redhat.com, cdewolf@redhat.com, cfu@redhat.com, chazlett@redhat.com, clement.escoffier@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dchen@redhat.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, edewata@redhat.com, eleandro@redhat.com, eric.wittmann@redhat.com, fjuma@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gsmet@redhat.com, hamadhan@redhat.com, hbraun@redhat.com, hhudgeon@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jmagne@redhat.com, jochrist@redhat.com, jpallich@redhat.com, jperkins@redhat.com, jwon@redhat.com, kaycoth@redhat.com, krathod@redhat.com, kwills@redhat.com, lgao@redhat.com, lthon@redhat.com, lzap@redhat.com, mkdineshprasanth@gmail.com, mmccune@redhat.com, msochure@redhat.com, msvehla@redhat.com, mszynkie@redhat.com, nmoumoul@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pcreech@redhat.com, peholase@redhat.com, pgallagh@redhat.com, pjindal@redhat.com, pmackay@redhat.com, probinso@redhat.com, puntogil@libero.it, rchan@redhat.com, rguimara@redhat.com, rhcs-maint@redhat.com, rjerrido@redhat.com, rruss@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, sbiarozk@redhat.com, sdouglas@redhat.com, smaestri@redhat.com, sokeeffe@redhat.com, tbrisker@redhat.com, tom.jenkinson@redhat.com, weli@redhat.com, yborgess@redhat.com Blocks: 1941409 Target Milestone: --- Classification: Other
A cross-site scripting (XSS) flaw was found in RESTEasy, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. An attacker could use this flaw to launch a reflected XSS attack.
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
--- Comment #1 from Ted (Jong Seok) Won jwon@redhat.com --- Acknowledgments:
Name: Jeremy Bonghwan Choi (Red Hat), Ted Jongseok Won (Red Hat)
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
--- Comment #3 from Ted (Jong Seok) Won jwon@redhat.com --- External References:
https://issues.redhat.com/browse/RESTEASY-2858
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|RESTEasy: PathParam in |CVE-2021-20293 RESTEasy: |RESTEasy can lead to a |PathParam in RESTEasy can |reflected XSS attack |lead to a reflected XSS | |attack Alias| |CVE-2021-20293
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Yadnyawalk Tale ytale@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1943648
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |pdrozd@redhat.com, | |sthorger@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1945667, 1945669, 1945668
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2021-09-06 14:54:57
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHINT Service Registry 2.0.2 GA
Via RHSA-2021:4100 https://access.redhat.com/errata/RHSA-2021:4100
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4100
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHINT Camel-K 1.6.4
Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
https://bugzilla.redhat.com/show_bug.cgi?id=1942819
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1029
java-sig-commits@lists.fedoraproject.org