Security fix for CVE-2020-1695

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7351-1 advisory.

    Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An     attacker could possibly use this issue to modify the app's behavior for other users through the network.
    (CVE-2020-10688)

    Mirko Selber discovered that RESTEasy improperly validated user input during HTTP response construction.
    This issue could possibly allow an attacker to cause a denial of service or execute arbitrary code.
    (CVE-2020-1695)

    It was discovered that RESTEasy unintentionally disclosed potentially sensitive server information to     users during the handling of certain errors. (CVE-2020-25633)

    It was discovered that RESTEasy unintentionally disclosed parts of its code to users during the handling     of certain errors. (CVE-2021-20289)

    It was discovered that RESTEasy used improper permissions when creating temporary files. An attacker could     possibly use this issue to get access to sensitive data. (CVE-2023-0482)

    It was discovered that RESTEasy improperly handled certain HTTP requests and could be forced into a state     in which it can no longer accept incoming connections. An attacker could possibly use this issue to cause     a denial of service. (CVE-2024-9622)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7630-1 advisory.

    It was discovered that RESTEasy made insufficient use of random values in asynchronous jobs. An attacker     could possibly use this issue to steal user data. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2016-6345)

    It was discovered that RESTEasy enabled a vulnerable GZIP decompression module by default. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2016-6346)

    It was discovered that RESTEasy improperly made use of unsanitized data while handling certain errors. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 14.04 LTS. (CVE-2016-6347)

    It was discovered that RESTEasy enabled a vulnerable JSON manipulation module by default. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only     affected Ubuntu 14.04 LTS. (CVE-2016-6348)

    It was discovered that RESTEasy enabled a vulnerable deserialization module by default. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS. (CVE-2016-7050)

    Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An     attacker could possibly use this issue to modify the app's behavior for other users throughout the     network. This issue did not affect resteasy3.0 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2020-10688)

    Mirko Selber discovered that RESTEasy improperly validated user input during HTTP response construction.
    An attacker could possibly use this issue to to cause a denial of service or execute arbitrary code. This     issue did not affect resteasy3.0 in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2020-1695)

    It was discovered that RESTEasy improperly handled receiving the WebApplicationException during a client     call. An attacker could possibly use this issue to obtain potentially sensitive server information.
    (CVE-2020-25633)

    It was discovered that RESTEasy improperly populated exception responses with endpoint class and method     names. An attacker could possibly use this issue to obtain potentially sensitive server information.
    (CVE-2021-20289)

    It was discovered that RESTEasy used improper permissions when creating temporary files. An attacker could     possibly use this issue to get access to sensitive data. (CVE-2023-0482)

    It was discovered that RESTEasy improperly handled certain HTTP requests containing ASCII control     characters. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-9622)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1775 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1775 advisory.

    - Bug 1914396 - CVE-2021-20179 pki-core:10.6/pki-core: Unprivileged users can renew any certificate
    - CVE-2020-1695: Improper validation of response header in MediaTypeHeaderDelegate.java class       Resolves: rh-bz#1845548

    tomcatjss

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2278:01 advisory.

    * resteasy: Improper validation of response header in     MediaTypeHeaderDelegate.java class (CVE-2020-1695)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3637 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.9 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.8, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.9 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

     wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is     received causing Denial of Service (CVE-2020-14307)

    * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service     (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1775 advisory.

  - resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3638 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.9 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.8, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.9 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

     wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is     received causing Denial of Service (CVE-2020-14307)

    * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service     (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143595	Fedora 33 : resteasy (2020-df970da9fc)	Nessus	Fedora Local Security Checks	2020/12/9	2024/2/6	high
232708	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RESTEasy vulnerabilities (USN-7351-1)	Nessus	Ubuntu Local Security Checks	2025/3/13	2025/3/13	high
242054	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : RESTEasy vulnerabilities (USN-7630-1)	Nessus	Ubuntu Local Security Checks	2025/7/14	2025/7/14	medium
149656	RHEL 8 : pki-core:10.6 and pki-deps:10.6 (RHSA-2021:1775)	Nessus	Red Hat Local Security Checks	2021/5/19	2025/4/29	high
155318	Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2021-1775)	Nessus	Oracle Linux Local Security Checks	2021/11/12	2024/11/1	high
294715	MiracleLinux 8 : pki-deps:10.6 (AXSA:2021-2278:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
140397	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 (RHSA-2020:3637)	Nessus	Red Hat Local Security Checks	2020/9/8	2024/11/7	critical
143598	Fedora 32 : resteasy (2020-239503f5fa)	Nessus	Fedora Local Security Checks	2020/12/9	2024/2/6	high
149748	CentOS 8 : pki-core:10.6 and pki-deps:10.6 (CESA-2021:1775)	Nessus	CentOS Local Security Checks	2021/5/19	2023/2/8	high
140390	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 (RHSA-2020:3638)	Nessus	Red Hat Local Security Checks	2020/9/8	2024/11/7	critical

检测

插件搜索

high

high

medium

high

high

high

critical

high

high

critical