Read the docs
TI-2017-05202 Aliases CVE-2017-7561GHSA-57q5-x8jf-g7h8

Origin validation error in Red Hat resteasy

Priority LOW 36CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.

Summary

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

Why it matters now

EPSS 0.01354 71st percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-jaxrs (Maven): 3.0.25.Final, 3.5.0.CR1Red Hat: 8 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatresteasy3.0.7 through before 4.0.0Beta1—No fix listedCNA
—org.jboss.resteasy:resteasy-jaxrs (Maven)3.0.7.Final to before 3.0.25.Final3.0.25.FinalPatch availableGHSA-57q5-x8jf-g7h8
—org.jboss.resteasy:resteasy-jaxrs (Maven)3.1.4.Final to before 3.5.0.CR13.5.0.CR1Patch availableGHSA-57q5-x8jf-g7h8
  • resteasy VendorRed Hat Affected 3.0.7 through before 4.0.0Beta1 Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-jaxrs (Maven) Vendor— Affected 3.0.7.Final to before 3.0.25.Final Fixed in 3.0.25.Final Patch available GHSA-57q5-x8jf-g7h8
  • org.jboss.resteasy:resteasy-jaxrs (Maven) Vendor— Affected 3.1.4.Final to before 3.5.0.CR1 Fixed in 3.5.0.CR1 Patch available GHSA-57q5-x8jf-g7h8

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.0.8:*:*:*:*:*:*:*3.0.8VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·Red Hat
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.9:*:*:*:*:*:*:*3.2.9VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.13:*:*:*:*:*:*:*3.2.13VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.5.1:*:*:*:*:*:*:*3.5.1VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.2.13:*:*:*:*:*:*:* Versions 3.2.13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-57q5-x8jf-g7h8 org.jboss.resteasy:resteasy-jaxrs (Maven) Fixed in 3.0.25.Final Advisory →
  • Fix · GHSA-57q5-x8jf-g7h8 org.jboss.resteasy:resteasy-jaxrs (Maven) Fixed in 3.5.0.CR1 Advisory →

Red Hat 8 advisories

  • RHSA-2018:0481 Released 2018-03-12 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.1.1
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el7
  • RHSA-2018:0479 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el6 +47
  • RHSA-2018:0480 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 for RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el7 +47
Show 5 more Red Hat advisories
  • RHSA-2018:0478 Released 2018-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.1 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:0005 Released 2018-01-03 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el7
  • RHSA-2018:0004 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el7 +47
  • RHSA-2018:0002 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el6 +47
  • RHSA-2018:0003 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update
    • Red Hat JBoss EAP 7.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss EAP 7.0Fixed RHSA-2018:0003
Red Hat JBoss EAP 7.1Fixed RHSA-2018:0478
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2018:0002, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2018:0004, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:0479, RHSA-2018:0481
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:0480, RHSA-2018:0481
Not affected: 5 products
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Operations Network 3
  • Red Hat OpenShift Application Runtimes
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7561
  2. 2026-10-03 Alias added: GHSA-57q5-x8jf-g7h8
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Patch 1

Advisory 9

Other 1

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences