Description

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL/

Related Vulnerabilities

CVE-2022-39236 Vulnerability in npm package matrix-js-sdk

CVE-2022-2596 Vulnerability in maven package org.webjars.npm:node-fetch

CVE-2021-34078 Vulnerability in npm package lifion-verify-deps

CVE-2021-44684 Vulnerability in npm package github-todos

CVE-2022-24999 Vulnerability in npm package express

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Issue Tracking Patch Vendor Advisory NVD-CWE-Other