Read the docs
TI-2011-04520 Aliases CVE-2011-5245GHSA-g4jg-gpwv-p7wv

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2…

Priority LOW 29CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 14 fixed, 4 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

Why it matters now

EPSS 0.03213 88th percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-jaxb-provider (Maven): 2.3.2Red Hat: 10 advisoriesRed Hat: 14 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jboss.resteasy:resteasy-jaxb-provider (Maven)before 2.3.22.3.2Patch availableGHSA-g4jg-gpwv-p7wv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-jaxb-provider (Maven) Vendor— Affected before 2.3.2 Fixed in 2.3.2 Patch available GHSA-g4jg-gpwv-p7wv

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*up to 2.3.1VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:1.1:*:*:*:*:*:*:*1.1VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:1.2:*:*:*:*:*:*:*1.2VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions up to 2.3.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Red Hat
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:resteasy:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableRed Hat
cpe:2.3:a:redhat:resteasy:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableRed Hat
  • cpe:2.3:a:redhat:resteasy:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-g4jg-gpwv-p7wv org.jboss.resteasy:resteasy-jaxb-provider (Maven) Fixed in 2.3.2 Advisory →

Red Hat 10 advisories

  • RHSA-2014:0372 Released 2014-04-03 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.1 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:0371 Released 2014-04-03 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.1 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2012:1125 Released 2012-07-31 · Red Hat rating Important
    JBoss Enterprise SOA Platform 5.3.0 update
    • Red Hat JBoss SOA Platform 5.3
Show 7 more Red Hat advisories
  • RHSA-2012:1059 Released 2012-07-05 · Red Hat rating Moderate
    resteasy security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS resteasy-1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el4 +1
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES resteasy-1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el4, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el4 +1
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server resteasy-1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el5 +1
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server resteasy-1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el6 +1
  • RHSA-2012:1058 Released 2012-07-05 · Red Hat rating Moderate
    resteasy security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server resteasy-1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el5, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el5 +1
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server resteasy-1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-examples-1.2.1-10.CP02_patch01.1.ep5.el6, resteasy-javadoc-1.2.1-10.CP02_patch01.1.ep5.el6 +1
  • RHSA-2012:1057 Released 2012-07-05 · Red Hat rating Moderate
    resteasy security update
    • Red Hat JBoss Web Platform 5.1
  • RHSA-2012:1056 Released 2012-07-05 · Red Hat rating Moderate
    resteasy security update
    • Red Hat JBoss Enterprise Application Platform 5.1
  • RHSA-2012:0519 Released 2012-04-25 · Red Hat rating Moderate
    JBoss Enterprise Portal Platform 5.2.1 update
    • Red Hat JBoss Portal 5.2
  • RHSA-2012:0441 Released 2012-04-02 · Red Hat rating Moderate
    JBoss Enterprise BRMS Platform 5.2.0 update
    • JBoss Enterprise BRMS Platform 5.2
  • RHSA-2012:0421 Released 2012-03-26 · Red Hat rating Moderate
    rhevm security and bug fix update
    • RHEV-M for Servers rhevm-3.0.3_0001-3.el6, rhevm-backend-3.0.3_0001-3.el6, rhevm-config-3.0.3_0001-3.el6 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Data Virtualization 6AffectedNo fix yet
Red Hat JBoss SOA Platform 5AffectedNo fix yet
Red Hat Storage 2AffectedNo fix yet
JBoss Enterprise BRMS Platform 5.2Fixed RHSA-2012:0441
RHEV-M for ServersFixed RHSA-2012:0421
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0371
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0372
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2012:1059
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2012:1059
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2012:1059
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2012:1059
Red Hat JBoss Enterprise Application Platform 5.1Fixed RHSA-2012:1056
Red Hat JBoss Portal 5.2Fixed RHSA-2012:0519
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2012:1125
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2012:1058
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2012:1058
Red Hat JBoss Web Platform 5.1Fixed RHSA-2012:1057
Not affected: 2 products
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-5245
  2. 2026-10-03 Alias added: GHSA-g4jg-gpwv-p7wv

References

Patch 1

Advisory 10

Other 5

  • TI-2016-07827 Improper input validation in Red Hat RESTEasy CVSS 3.0HIGH 8.1
  • TI-2016-05434 RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. CVSS 3.0HIGH 7.5
  • TI-2014-02817 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise… CVSS 2.0HIGH 7.5
  • TI-2018-00972 Improper input validation in Red Hat resteasy CVSS 3.0HIGH 8.1
  • TI-2020-01642 Improper input validation in Red Hat resteasy CVSS 3.1HIGH 7.5
  • TI-2020-11197 Uncontrolled resource consumption in RESTEasy CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences