CVE-2011-5245
Fixed in a distro release EPSS 3%
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Products: redhat resteasy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jboss.resteasy:resteasy-jaxb-provider | 2.3.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 5 | resteasy | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | resteasy | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise application platform 5 | resteasy | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | resteasy-examples | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | resteasy-examples | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | resteasy-examples | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise application platform 5 | resteasy-javadoc | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | resteasy-javadoc | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | resteasy-javadoc | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise application platform 5 | resteasy-manual | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | resteasy-manual | 0:1.2.1-10.CP02_patch01.1.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | resteasy-manual | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise web platform 5 | resteasy | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | resteasy | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise web platform 5 | resteasy-examples | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | resteasy-examples | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise web platform 5 | resteasy-javadoc | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | resteasy-javadoc | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat jboss enterprise web platform 5 | resteasy-manual | 0:1.2.1-10.CP02_patch01.1.ep5.el5 |
| Red Hat jboss enterprise web platform 5 | resteasy-manual | 0:1.2.1-10.CP02_patch01.1.ep5.el6 |
| Red Hat rhev manager 3 | rhevm | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-backend | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-config | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-dbscripts | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-debuginfo | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-genericapi | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-iso-uploader | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-jboss-deps | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-log-collector | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-notification-service | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-restapi | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-setup | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-tools-common | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-userportal | 0:3.0.3_0001-3.el6 |
| Red Hat rhev manager 3 | rhevm-webadmin-portal | 0:3.0.3_0001-3.el6 |