{"id":"GHSA-pc54-pchm-xcw6","summary":"XML External Entity Reference in RESTEasy","details":"DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.","aliases":["CVE-2014-7839"],"modified":"2024-12-07T05:39:57.116831Z","published":"2022-05-17T04:13:50Z","database_specific":{"github_reviewed_at":"2022-06-17T01:12:47Z","nvd_published_at":"2014-11-25T15:59:00Z","cwe_ids":["CWE-20","CWE-611"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7839"},{"type":"WEB","url":"https://github.com/resteasy/resteasy/pull/611/commits/3ab999c899c455a0b0a00bf5e455ed3e8d9ae347"},{"type":"WEB","url":"https://github.com/resteasy/resteasy/pull/611/commits/8b5d8cfc963794a74636d9a840e899408ec8fdc6"},{"type":"PACKAGE","url":"https://github.com/resteasy/Resteasy"},{"type":"WEB","url":"https://issues.jboss.org/browse/RESTEASY-1130"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0773.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0850.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0851.html"}],"affected":[{"package":{"name":"org.jboss.resteasy:resteasy-jaxrs","ecosystem":"Maven","purl":"pkg:maven/org.jboss.resteasy/resteasy-jaxrs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11.Final"}]}],"versions":["1.0-RC1","1.0-beta-6","1.0-beta-7","1.0-beta-8","1.0-beta-9","1.0.0.GA","1.0.1.GA","1.0.2.GA","1.1-RC1","1.1-RC2","1.1.GA","1.2.1.GA","1.2.GA","1.2.RC1","2.0-RC1","2.0-beta-1","2.0-beta-2","2.0-beta-3","2.0-beta-4","2.0.0.GA","2.0.1.GA","2.1-beta-1","2.1.0.GA","2.2-RC-1","2.2-beta-1","2.2.0.GA","2.2.1.GA","2.2.2.GA","2.2.3.GA","2.3-RC1","2.3-beta-1","2.3.0.GA","2.3.1.GA","2.3.10.Final","2.3.2.Final","2.3.3.Final","2.3.4.Final","2.3.5.Final","2.3.6.Final","2.3.7.Final","3.0-beta-1","3.0-beta-2","3.0-beta-3","3.0-beta-4","3.0-beta-5","3.0-beta-6","3.0-rc-1","3.0.0.Final","3.0.1.Final","3.0.10.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.0.5.Final","3.0.6.Final","3.0.7.Final","3.0.8.Final","3.0.9.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pc54-pchm-xcw6/GHSA-pc54-pchm-xcw6.json","last_known_affected_version_range":"\u003c= 3.0.10.Final"}}],"schema_version":"1.9.0"}