CVE-2020-1695

CVE-2020-1695, security advisory, suse linux, suse, security, cve

CVE-2020-1695

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2020-1695 at MITRE

Description

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.5
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	High
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1172141 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 8	apache-commons-collections >= 3.2.2-10.module+el8.1.0+3366+6dfb954c apache-commons-lang >= 2.6-21.module+el8.1.0+3366+6dfb954c apache-commons-net >= 3.6-3.module+el8.3.0+6805+72837426 bea-stax-api >= 1.2.0-16.module+el8.1.0+3366+6dfb954c glassfish-fastinfoset >= 1.2.13-9.module+el8.1.0+3366+6dfb954c glassfish-jaxb-api >= 2.2.12-8.module+el8.1.0+3366+6dfb954c glassfish-jaxb-core >= 2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-runtime >= 2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-txw2 >= 2.2.11-11.module+el8.1.0+3366+6dfb954c jackson-annotations >= 2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-core >= 2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-databind >= 2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-jaxrs-json-provider >= 2.9.9-1.module+el8.1.0+3832+9784644d jackson-jaxrs-providers >= 2.9.9-1.module+el8.1.0+3832+9784644d jackson-module-jaxb-annotations >= 2.7.6-4.module+el8.1.0+3366+6dfb954c jakarta-commons-httpclient >= 3.1-28.module+el8.1.0+3366+6dfb954c javassist >= 3.18.1-8.module+el8.1.0+3366+6dfb954c javassist-javadoc >= 3.18.1-8.module+el8.1.0+3366+6dfb954c jss >= 4.8.1-2.module+el8.4.0+10451+3e5b5448 jss-javadoc >= 4.8.1-2.module+el8.4.0+10451+3e5b5448 ldapjdk >= 4.22.0-1.module+el8.3.0+6784+6e1e4c62 ldapjdk-javadoc >= 4.22.0-1.module+el8.3.0+6784+6e1e4c62 pki-acme >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-base >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-base-java >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-ca >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-kra >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-server >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-servlet-4.0-api >= 9.0.30-1.module+el8.3.0+6730+8f9c6254 pki-servlet-engine >= 9.0.30-1.module+el8.3.0+6730+8f9c6254 pki-symkey >= 10.10.5-2.module+el8.4.0+10466+9830f79e pki-tools >= 10.10.5-2.module+el8.4.0+10466+9830f79e python-nss-doc >= 1.0.1-10.module+el8.1.0+3366+6dfb954c python3-nss >= 1.0.1-10.module+el8.1.0+3366+6dfb954c python3-pki >= 10.10.5-2.module+el8.4.0+10466+9830f79e relaxngDatatype >= 2011.1-7.module+el8.1.0+3366+6dfb954c resteasy >= 3.0.26-6.module+el8.4.0+8891+bb8828ef slf4j >= 1.7.25-4.module+el8.1.0+3366+6dfb954c slf4j-jdk14 >= 1.7.25-4.module+el8.1.0+3366+6dfb954c stax-ex >= 1.7.7-8.module+el8.2.0+5723+4574fbff tomcatjss >= 7.6.1-1.module+el8.4.0+8778+d07929ff velocity >= 1.7-24.module+el8.1.0+3366+6dfb954c xalan-j2 >= 2.7.1-38.module+el8.1.0+3366+6dfb954c xerces-j2 >= 2.11.0-34.module+el8.1.0+3366+6dfb954c xml-commons-apis >= 1.4.01-25.module+el8.1.0+3366+6dfb954c xml-commons-resolver >= 1.2-26.module+el8.1.0+3366+6dfb954c xmlstreambuffer >= 1.5.4-8.module+el8.2.0+5723+4574fbff xsom >= 0-19.20110809svn.module+el8.1.0+3366+6dfb954c	Patchnames: RHSA-2021:1775

---

SUSE Timeline for this CVE

CVE page created: Wed Apr 15 07:54:16 2020
CVE page last modified: Mon Oct 30 18:06:46 2023