Read the docs
TI-2020-15651 Aliases CVE-2020-25633GHSA-hr32-mgpm-qf2f

Information disclosure through error messages in Red Hat resteasy-client

Priority LOW 26CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 9 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

Why it matters now

EPSS 0.01178 67th percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-client (Maven): 4.5.7.Final, 3.14.0.Finalorg.jboss.resteasy:resteasy-client-microprofile (Maven): 4.5.7.Final, 3.14.0.FinalRed Hat: 10 advisoriesRed Hat: 9 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatresteasy-clientthrough 4.5.6—No fix listedCNA
—org.jboss.resteasy:resteasy-client (Maven)4.0.0 to before 4.5.7.Final4.5.7.FinalPatch availableGHSA-hr32-mgpm-qf2f
—org.jboss.resteasy:resteasy-client-microprofile (Maven)4.0.0 to before 4.5.7.Final4.5.7.FinalPatch availableGHSA-hr32-mgpm-qf2f
—org.jboss.resteasy:resteasy-client (Maven)before 3.14.0.Final3.14.0.FinalPatch availableGHSA-hr32-mgpm-qf2f
—org.jboss.resteasy:resteasy-client-microprofile (Maven)before 3.14.0.Final3.14.0.FinalPatch availableGHSA-hr32-mgpm-qf2f
  • resteasy-client VendorRed Hat Affected through 4.5.6 Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-client (Maven) Vendor— Affected 4.0.0 to before 4.5.7.Final Fixed in 4.5.7.Final Patch available GHSA-hr32-mgpm-qf2f
  • org.jboss.resteasy:resteasy-client-microprofile (Maven) Vendor— Affected 4.0.0 to before 4.5.7.Final Fixed in 4.5.7.Final Patch available GHSA-hr32-mgpm-qf2f
  • org.jboss.resteasy:resteasy-client (Maven) Vendor— Affected before 3.14.0.Final Fixed in 3.14.0.Final Patch available GHSA-hr32-mgpm-qf2f
  • org.jboss.resteasy:resteasy-client-microprofile (Maven) Vendor— Affected before 3.14.0.Final Fixed in 3.14.0.Final Patch available GHSA-hr32-mgpm-qf2f

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*before 3.14.0; 4.5.0 – 4.5.6VulnerableRed Hat
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.11.6Vulnerablequarkusio
  • cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions before 3.14.0; 4.5.0 – 4.5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.11.6 Vulnerable ·quarkusio

Remediation

  • Fix · GHSA-hr32-mgpm-qf2f org.jboss.resteasy:resteasy-client (Maven) Fixed in 4.5.7.Final Advisory →
  • Fix · GHSA-hr32-mgpm-qf2f org.jboss.resteasy:resteasy-client-microprofile (Maven) Fixed in 4.5.7.Final Advisory →
  • Fix · GHSA-hr32-mgpm-qf2f org.jboss.resteasy:resteasy-client (Maven) Fixed in 3.14.0.Final Advisory →
  • Fix · GHSA-hr32-mgpm-qf2f org.jboss.resteasy:resteasy-client-microprofile (Maven) Fixed in 3.14.0.Final Advisory →

Red Hat 10 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:2858 Released 2021-07-21 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.0 update
    • Red Hat JBoss Enterprise Application Platform org.jboss.resteasy.resteasy-client-3.15.1.Final-redhat-00001.jar
  • RHSA-2021:1313 Released 2021-04-21 · Red Hat rating Moderate
    Satellite 6.9 Release
    • Red Hat Satellite 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
    • Red Hat Satellite Capsule 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
Show 7 more Red Hat advisories
  • RHSA-2021:1004 Released 2021-03-29 · Red Hat rating Moderate
    Red Hat build of Quarkus 1.11.6 release and security update
    • Text-Only RHOAR
  • RHSA-2021:0295 Released 2021-02-08 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.3 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Integration Service RegistryAffectedNo fix yet: Fix deferred
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Continuous DeliveryAffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:2858
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat Satellite 6.9Fixed RHSA-2021:1313
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Text-Only RHOARFixed RHSA-2021:0295
Not affected: 7 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat Satellite 6.9
  • Red Hat Satellite Capsule 6.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25633
  2. 2026-10-03 Alias added: GHSA-hr32-mgpm-qf2f

References

Advisory 2

Other 2

  • TI-2016-07827 Improper input validation in Red Hat RESTEasy CVSS 3.0HIGH 8.1
  • TI-2016-05434 RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. CVSS 3.0HIGH 7.5
  • TI-2014-02817 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise… CVSS 2.0HIGH 7.5
  • TI-2018-00972 Improper input validation in Red Hat resteasy CVSS 3.0HIGH 8.1
  • TI-2020-01642 Improper input validation in Red Hat resteasy CVSS 3.1HIGH 7.5
  • TI-2020-11197 Uncontrolled resource consumption in RESTEasy CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences