A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an applica...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Debian:12resteasy3.0 |
All versions→ Not listed |
Not listed |
| Debian:13resteasy3.0 |
All versions→ Not listed |
Not listed |
| Debian:14resteasy3.0 |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security-tracker.debian.org