In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider…
Priority LOW 24CWE-378Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 14 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 18th percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-core (Maven): 6.2.3.Final, 5.0.6.Final, 4.7.8.Final +1org.jboss.resteasy:resteasy-multipart-provider (Maven): 6.2.3.Final, 5.0.6.Final, 4.7.8.Final +1Red Hat: 14 advisoriesRed Hat: 14 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | RESTEasy | Fixed in RESTEasy 4.7.8.Final | — | No fix listed | CNA |
| — | org.jboss.resteasy:resteasy-core (Maven) | 6.0.0.Beta1 to before 6.2.3.Final | 6.2.3.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-core (Maven) | 5.0.0.Alpha1 to before 5.0.6.Final | 5.0.6.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-core (Maven) | 4.0.0.Beta1 to before 4.7.8.Final | 4.7.8.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-multipart-provider (Maven) | 6.0.0.Beta1 to before 6.2.3.Final | 6.2.3.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-multipart-provider (Maven) | 5.0.0.Alpha1 to before 5.0.6.Final | 5.0.6.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-multipart-provider (Maven) | 4.0.0.Beta1 to before 4.7.8.Final | 4.7.8.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-multipart-provider (Maven) | before 3.15.5.Final | 3.15.5.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
| — | org.jboss.resteasy:resteasy-core (Maven) | before 3.15.5.Final | 3.15.5.Final | Patch available | GHSA-2c6g-pfx3-w7h8 |
- RESTEasy Vendor— Affected Fixed in RESTEasy 4.7.8.Final Fixed in — No fix listed CNA
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 6.0.0.Beta1 to before 6.2.3.Final Fixed in 6.2.3.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 5.0.0.Alpha1 to before 5.0.6.Final Fixed in 5.0.6.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 4.0.0.Beta1 to before 4.7.8.Final Fixed in 4.7.8.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-multipart-provider (Maven) Vendor— Affected 6.0.0.Beta1 to before 6.2.3.Final Fixed in 6.2.3.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-multipart-provider (Maven) Vendor— Affected 5.0.0.Alpha1 to before 5.0.6.Final Fixed in 5.0.6.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-multipart-provider (Maven) Vendor— Affected 4.0.0.Beta1 to before 4.7.8.Final Fixed in 4.7.8.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-multipart-provider (Maven) Vendor— Affected before 3.15.5.Final Fixed in 3.15.5.Final Patch available GHSA-2c6g-pfx3-w7h8
- org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected before 3.15.5.Final Fixed in 3.15.5.Final Patch available GHSA-2c6g-pfx3-w7h8
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:resteasy:3.15.4:*:*:*:*:*:*:* | 3.15.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:resteasy:4.7.7:*:*:*:*:*:*:* | 4.7.7 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:resteasy:5.0.5:*:*:*:*:*:*:* | 5.0.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:resteasy:6.2.2:*:*:*:*:*:*:* | 6.2.2 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:resteasy:3.15.4:*:*:*:*:*:*:* Versions 3.15.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:resteasy:4.7.7:*:*:*:*:*:*:* Versions 4.7.7 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:resteasy:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:resteasy:6.2.2:*:*:*:*:*:*:* Versions 6.2.2 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-core (Maven) Fixed in 6.2.3.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-core (Maven) Fixed in 5.0.6.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-core (Maven) Fixed in 4.7.8.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-multipart-provider (Maven) Fixed in 6.2.3.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-multipart-provider (Maven) Fixed in 5.0.6.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-multipart-provider (Maven) Fixed in 4.7.8.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-multipart-provider (Maven) Fixed in 3.15.5.Final Advisory →
- Fix · GHSA-2c6g-pfx3-w7h8 org.jboss.resteasy:resteasy-core (Maven) Fixed in 3.15.5.Final Advisory →
Red Hat 14 advisories
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
- RHSA-2023:6305 Released 2023-11-06 · Red Hat rating ImportantMigration Toolkit for Applications security update
- MTA 6.1 for RHEL 8 mta/mta-hub-rhel8, mta/mta-operator-bundle, mta/mta-pathfinder-rhel8 +3
- RHSA-2023:5165 Released 2023-09-14 · Red Hat rating ImportantRed Hat AMQ Streams 2.5.0 release and security update
- Red Hat AMQ Streams 2.5.0
Show 11 more Red Hat advisories
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
- RHSA-2023:3185 Released 2023-05-17 · Red Hat rating ImportantRed Hat AMQ Broker 7.10.3 release and security update
- AMQ Broker 7.10.3
- RHSA-2023:2710 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:2713 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update
- Red Hat Single Sign-On 7
- RHSA-2023:2706 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso
- RHSA-2023:2707 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el9sso
- RHSA-2023:2705 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el7sso
- RHSA-2023:1516 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 security update
- Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
- RHSA-2023:1512 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
- RHSA-2023:1513 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
- RHSA-2023:1514 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Red Hat A-MQ Online | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet |
| AMQ Broker 7.10.3 | Fixed | RHSA-2023:3185 |
| MTA 6.1 for RHEL 8 | Fixed | RHSA-2023:6305 |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:2710 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:1512 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:1513 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:1514 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:1516 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:2713 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:2705 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:2706 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:2707 |
Not affected: 7 products
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2023-0482
- 2026-10-03 Alias added: GHSA-2c6g-pfx3-w7h8
References
Patch 1
Advisory 2
Other 13
- https://github.com/resteasy/resteasy/security/advisories/GHSA-2c6g-pfx3-w7h8
- https://github.com/resteasy/resteasy/pull/3409
- https://github.com/resteasy/resteasy/pull/3410
- https://github.com/resteasy/resteasy/pull/3412
- https://github.com/resteasy/resteasy/pull/3413
- https://github.com/resteasy/resteasy/pull/3423
- https://bugzilla.redhat.com/show_bug.cgi?id=2166004
- https://github.com/orgs/resteasy/discussions/3415
- https://github.com/orgs/resteasy/discussions/3504
- https://github.com/orgs/resteasy/discussions/3506
- https://github.com/resteasy/resteasy
- https://issues.redhat.com/browse/RESTEASY-3286
- https://security.netapp.com/advisory/ntap-20230427-0001
Sources
- CVE-2023-0482 · CVE Program
- CVE-2023-0482 · NVD
- FIRST EPSS
- GHSA-2c6g-pfx3-w7h8 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-0482 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences