Information disclosure through error messages in resteasy
Priority LOW 27CWE-209Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 19 fixed, 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.
Summary
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
Why it matters now
EPSS 0.014 72nd percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-core (Maven): 4.6.1, 4.5.10, 3.16.0Red Hat: 19 advisoriesRed Hat: 19 fixed, 18 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | resteasy | resteasy 3.11.5.Final, resteasy 3.15.2.Final, resteasy 4.5.10.Final, resteasy 4.6.1.Final, resteasy 4.6.2.Final | — | No fix listed | CNA |
| — | org.jboss.resteasy:resteasy-core (Maven) | 4.6.0 to before 4.6.1 | 4.6.1 | Patch available | GHSA-244r-fcj3-ghjq |
| — | org.jboss.resteasy:resteasy-core (Maven) | 4.0.0 to before 4.5.10 | 4.5.10 | Patch available | GHSA-244r-fcj3-ghjq |
| — | org.jboss.resteasy:resteasy-core (Maven) | 3.0.0 to before 3.16.0 | 3.16.0 | Patch available | GHSA-244r-fcj3-ghjq |
- resteasy Vendor— Affected resteasy 3.11.5.Final, resteasy 3.15.2.Final, resteasy 4.5.10.Final, resteasy 4.6.1.Final, resteasy 4.6.2.Final Fixed in — No fix listed CNA
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 4.6.0 to before 4.6.1 Fixed in 4.6.1 Patch available GHSA-244r-fcj3-ghjq
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 4.0.0 to before 4.5.10 Fixed in 4.5.10 Patch available GHSA-244r-fcj3-ghjq
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 3.0.0 to before 3.16.0 Fixed in 3.16.0 Patch available GHSA-244r-fcj3-ghjq
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* | up to 4.6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | before 1.13.4 | Vulnerable | quarkusio |
| cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
- cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions up to 4.6.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 1.13.4 Vulnerable ·quarkusio
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-244r-fcj3-ghjq org.jboss.resteasy:resteasy-core (Maven) Fixed in 4.6.1 Advisory →
- Fix · GHSA-244r-fcj3-ghjq org.jboss.resteasy:resteasy-core (Maven) Fixed in 4.5.10 Advisory →
- Fix · GHSA-244r-fcj3-ghjq org.jboss.resteasy:resteasy-core (Maven) Fixed in 3.16.0 Advisory →
Red Hat 19 advisories
- RHSA-2022:6407 Released 2022-09-09 · Red Hat rating ModerateRed Hat Integration Camel-K 1.8 security update
- RHAF Camel-K 1.8
- RHSA-2022:1179 Released 2022-04-12 · Red Hat rating ImportantRed Hat support for Spring Boot 2.5.10 update
- Red Hat Support for Spring Boot 2.5.10
- RHSA-2022:0164 Released 2022-01-18 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso75-openshift-rhel8
Show 16 more Red Hat advisories
- RHSA-2022:0155 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update
- RHSSO 7.5.1
- RHSA-2022:0152 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update on RHEL 8
- Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el8sso
- RHSA-2022:0151 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update on RHEL 7
- Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el7sso
- RHSA-2022:0146 Released 2022-01-17 · Red Hat rating ModerateEAP XP 2 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP 2 via EAP 7.3.x base
- RHSA-2021:5170 Released 2021-12-15 · Red Hat rating ModerateRed Hat Single Sign-On 7.4.10 security update
- Red Hat Single Sign-On 7.4.10
- RHSA-2021:5149 Released 2021-12-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el6eap +47
- RHSA-2021:5151 Released 2021-12-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-cxf-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el8eap +47
- RHSA-2021:5154 Released 2021-12-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.10 security update
- EAP 7.3.10 GA
- RHSA-2021:5150 Released 2021-12-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el7eap +47
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:4677 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.7.0-1.redhat_00001.1.el8eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el8eap +22
- RHSA-2021:4676 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.7.0-1.redhat_00001.1.el7eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el7eap +24
- RHSA-2021:4679 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update
- Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.12.Final-redhat-00001.jar, org.apache.santuario.xmlsec-2.1.7.redhat-00001.jar, org.apache.sshd.sshd-core-2.7.0.redhat-00001.jar +3
- RHSA-2021:4100 Released 2021-11-02 · Red Hat rating ModerateRed Hat Integration - Service Registry release and security update [2.0.2.GA]
- RHINT Service Registry 2.0.2 GA
- RHSA-2021:3880 Released 2021-10-20 · Red Hat rating ModerateRed Hat build of Quarkus 2.2.3 release and security update
- Red Hat build of Quarkus 2.2.3
- RHSA-2021:3700 Released 2021-09-30 · Red Hat rating ModerateRed Hat AMQ Broker 7.9.0 release and security update
- Red Hat AMQ 7.9.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat support for Spring Boot | Affected | No fix yet |
| EAP 7.3.10 GA | Fixed | RHSA-2021:5154 |
| Middleware Containers for OpenShift | Fixed | RHSA-2022:0164 |
| RHAF Camel-K 1.8 | Fixed | RHSA-2022:6407 |
| RHINT Service Registry 2.0.2 GA | Fixed | RHSA-2021:4100 |
| RHSSO 7.5.1 | Fixed | RHSA-2022:0155 |
| Red Hat AMQ 7.9.0 | Fixed | RHSA-2021:3700 |
| Red Hat EAP-XP 2 via EAP 7.3.x base | Fixed | RHSA-2022:0146 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2021:5151 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2021:5149 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2021:5150 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2021:4676 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2021:4677 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2021:4679 |
| Red Hat Single Sign-On 7.4.10 | Fixed | RHSA-2021:5170 |
| Red Hat Single Sign-On 7.5 for RHEL 7 Server | Fixed | RHSA-2022:0151 |
| Red Hat Single Sign-On 7.5 for RHEL 8 | Fixed | RHSA-2022:0152 |
| Red Hat Support for Spring Boot 2.5.10 | Fixed | RHSA-2022:1179 |
| Red Hat build of Quarkus 2.2.3 | Fixed | RHSA-2021:3880 |
Not affected: 6 products
- Red Hat Decision Manager 7
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20289
- 2026-10-03 Alias added: GHSA-244r-fcj3-ghjq
References
Advisory 2
Sources
- CVE-2021-20289 · CVE Program
- CVE-2021-20289 · NVD
- FIRST EPSS
- GHSA-244r-fcj3-ghjq · GitHub Advisory Database · CC BY 4.0
- CVE-2021-20289 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences