CVE-2020-1695

HIGH7.5EPSS 0.37%

Improper Input Validation in RESTEasy

發布日:2022/5/24修改日:2024/2/21

也稱為:GHSA-63cq-ppq8-cw6gDEBIAN-CVE-2020-1695

描述

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

受影響套件(2)

Debian/resteasy3.0from 0, < 3.0.26-2
Maven/org.jboss.resteasy:resteasy-client>= 4.0.0, < 4.6.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-1695
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-1695
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695
WEBhttps://github.com/resteasy/Resteasy/commit/88ba8537f2e8d465c7031d352bf9bb25526ce475
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ