A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7630-1 advisory.

    It was discovered that RESTEasy made insufficient use of random values in asynchronous jobs. An attacker     could possibly use this issue to steal user data. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2016-6345)

    It was discovered that RESTEasy enabled a vulnerable GZIP decompression module by default. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2016-6346)

    It was discovered that RESTEasy improperly made use of unsanitized data while handling certain errors. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 14.04 LTS. (CVE-2016-6347)

    It was discovered that RESTEasy enabled a vulnerable JSON manipulation module by default. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only     affected Ubuntu 14.04 LTS. (CVE-2016-6348)

    It was discovered that RESTEasy enabled a vulnerable deserialization module by default. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS. (CVE-2016-7050)

    Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An     attacker could possibly use this issue to modify the app's behavior for other users throughout the     network. This issue did not affect resteasy3.0 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2020-10688)

    Mirko Selber discovered that RESTEasy improperly validated user input during HTTP response construction.
    An attacker could possibly use this issue to to cause a denial of service or execute arbitrary code. This     issue did not affect resteasy3.0 in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2020-1695)

    It was discovered that RESTEasy improperly handled receiving the WebApplicationException during a client     call. An attacker could possibly use this issue to obtain potentially sensitive server information.
    (CVE-2020-25633)

    It was discovered that RESTEasy improperly populated exception responses with endpoint class and method     names. An attacker could possibly use this issue to obtain potentially sensitive server information.
    (CVE-2021-20289)

    It was discovered that RESTEasy used improper permissions when creating temporary files. An attacker could     possibly use this issue to get access to sensitive data. (CVE-2023-0482)

    It was discovered that RESTEasy improperly handled certain HTTP requests containing ASCII control     characters. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-9622)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7351-1 advisory.

    Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An     attacker could possibly use this issue to modify the app's behavior for other users through the network.
    (CVE-2020-10688)

    Mirko Selber discovered that RESTEasy improperly validated user input during HTTP response construction.
    This issue could possibly allow an attacker to cause a denial of service or execute arbitrary code.
    (CVE-2020-1695)

    It was discovered that RESTEasy unintentionally disclosed potentially sensitive server information to     users during the handling of certain errors. (CVE-2020-25633)

    It was discovered that RESTEasy unintentionally disclosed parts of its code to users during the handling     of certain errors. (CVE-2021-20289)

    It was discovered that RESTEasy used improper permissions when creating temporary files. An attacker could     possibly use this issue to get access to sensitive data. (CVE-2023-0482)

    It was discovered that RESTEasy improperly handled certain HTTP requests and could be forced into a state     in which it can no longer accept incoming connections. An attacker could possibly use this issue to cause     a denial of service. (CVE-2024-9622)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client     users to obtain the server's potentially sensitive information when the server got WebApplicationException     from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
    (CVE-2020-25633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1313 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * foreman: Managing repositories with their id via hammer does not respect the role filters     (CVE-2017-2662)
    * python-psutil: Double free because of refcount mishandling (CVE-2019-18874)
    * candlepin: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes     (CVE-2020-11612)
    * foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)
    * candlepin: resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)
    * python-django: potential SQL injection via tolerance parameter in GIS functions and aggregates on     Oracle (CVE-2020-9402)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Usability enhancements to Red Hat's Simple Content Access mode and Satellite

    * Usability improvements to enabling Remote Execution on your hosts.

    * Notifications in the UI to warn users when subscriptions are expiring.

    * Usability enhancements to enable Insights integration with Satellite.

    * Performance improvements to various aspects of the user interface and API.

    * Added support for OpenID Connect for authentication.

    * Usability improvements to the Satellite Installer.

    * Updated Ruby web server to the modern Puma application server which replaces Passenger.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0246 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.4, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.5 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

    * undertow: special character in query results in server errors (CVE-2020-27782)

    * wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to     domain-controller (CVE-2020-25689)

    * httpclient: apache-httpclient: incorrect handling of malformed authority component in request URIs     (CVE-2020-13956)

    * wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

    * resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0248 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.4, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise     Application Platform 7.3.5 Release Notes for information about the most significant bug fixes and     enhancements included in this release.

    Security Fix(es):

    * wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

    * undertow: special character in query results in server errors (CVE-2020-27782)

    * wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to     domain-controller (CVE-2020-25689)

    * httpclient: apache-httpclient: incorrect handling of malformed authority component in request URIs     (CVE-2020-13956)

    * wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

    * resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0247 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.4, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.5 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

    * undertow: special character in query results in server errors (CVE-2020-27782)

    * wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to     domain-controller (CVE-2020-25689)

    * httpclient: apache-httpclient: incorrect handling of malformed authority component in request URIs     (CVE-2020-13956)

    * wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

    * resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242054	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : RESTEasy vulnerabilities (USN-7630-1)	Nessus	Ubuntu Local Security Checks	medium
232708	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RESTEasy vulnerabilities (USN-7351-1)	Nessus	Ubuntu Local Security Checks	high
229925	Linux Distros Unpatched Vulnerability : CVE-2020-25633	Nessus	Misc.	medium
148903	RHEL 7 : Satellite 6.9 Release (Moderate) (RHSA-2021:1313)	Nessus	Red Hat Local Security Checks	critical
145408	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0246)	Nessus	Red Hat Local Security Checks	medium
145407	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0248)	Nessus	Red Hat Local Security Checks	medium
145405	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0247)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-25633

medium

Tenable Plugins

medium

high

medium

critical

medium

medium

medium