GHSA-2c6g-pfx3-w7h8

Source

https://github.com/advisories/GHSA-2c6g-pfx3-w7h8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-2c6g-pfx3-w7h8/GHSA-2c6g-pfx3-w7h8.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-2c6g-pfx3-w7h8

Aliases

CVE-2023-0482

Published

2025-01-15T18:56:57Z

Modified

2025-01-15T19:12:05.383417Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Insecure Temporary File in RESTEasy

Details

Impact

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

Patches

Fixed in the following pull requests:

https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1)
https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final)
https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final)
https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final)
https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)

Workarounds

There is no workaround for this issue.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-0482
https://bugzilla.redhat.com/show_bug.cgi?id=2166004
https://github.com/advisories/GHSA-jrmh-v64j-mjm9

Database specific

{
    "cwe_ids": [
        "CWE-378"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-15T18:56:57Z",
    "severity": "MODERATE",
    "nvd_published_at": null
}

References

Affected packages

Maven

org.jboss.resteasy:resteasy-core

Package

Name: org.jboss.resteasy:resteasy-core; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0.Beta1

Fixed

6.2.3.Final

Affected versions

6.*

6.0.0.Beta1

6.0.0.Final

6.0.1.Final

6.0.2.Final

6.0.3.Final

6.1.0.Alpha1

6.1.0.Beta1

6.1.0.Beta2

6.1.0.Beta3

6.1.0.Final

6.2.0.Beta1

6.2.0.Final

6.2.1.Final

6.2.2.Final

org.jboss.resteasy:resteasy-core

Package

Name: org.jboss.resteasy:resteasy-core; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0.Alpha1

Fixed

5.0.6.Final

Affected versions

5.*

5.0.0.Alpha1

5.0.0.Beta1

5.0.0.Beta2

5.0.0.Beta3

5.0.0.Final

5.0.1.Final

5.0.2.Final

5.0.3.Final

5.0.4.Final

5.0.5.Final

org.jboss.resteasy:resteasy-core

Package

Name: org.jboss.resteasy:resteasy-core; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0.Beta1

Fixed

4.7.8.Final

Affected versions

4.*

4.0.0.Beta6

4.0.0.Beta7

4.0.0.Beta8

4.0.0.CR1

4.0.0.CR2

4.0.0.CR3

4.0.0.Final

4.1.0.Final

4.1.1.Final

4.2.0.Final

4.3.0.Final

4.3.1.Final

4.4.0.CR1

4.4.0.Final

4.4.1.Final

4.4.2.Final

4.4.3.Final

4.5.0.Final

4.5.1.Final

4.5.2.Final

4.5.3.Final

4.5.4.Final

4.5.5.Final

4.5.6.Final

4.5.7.Final

4.5.8.SP1

4.5.8.Final

4.5.9.Final

4.5.10.Final

4.5.11.Final

4.5.12.Beta1

4.5.12.Final

4.6.0.Final

4.6.1.Alpha1

4.6.1.Beta1

4.6.1.Beta2

4.6.1.Beta3

4.6.1.Beta5

4.6.1.Beta6

4.6.1.Beta7

4.6.1.Beta8

4.6.1.Beta9

4.6.1.Final

4.6.2.Final

4.7.0.Beta1

4.7.0.Beta2

4.7.0.Beta3

4.7.0.Beta6

4.7.0.Beta7

4.7.0.Final

4.7.1.Final

4.7.2.Final

4.7.3.Final

4.7.4.Final

4.7.5.Final

4.7.6.Final

4.7.7.Final

org.jboss.resteasy:resteasy-multipart-provider

Package

Name: org.jboss.resteasy:resteasy-multipart-provider; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-multipart-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0.Beta1

Fixed

6.2.3.Final

Affected versions

6.*

6.0.0.Beta1

6.0.0.Final

6.0.1.Final

6.0.2.Final

6.0.3.Final

6.1.0.Alpha1

6.1.0.Beta1

6.1.0.Beta2

6.1.0.Beta3

6.1.0.Final

6.2.0.Beta1

6.2.0.Final

6.2.1.Final

6.2.2.Final

org.jboss.resteasy:resteasy-multipart-provider

Package

Name: org.jboss.resteasy:resteasy-multipart-provider; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-multipart-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0.Alpha1

Fixed

5.0.6.Final

Affected versions

5.*

5.0.0.Alpha1

5.0.0.Beta1

5.0.0.Beta2

5.0.0.Beta3

5.0.0.Final

5.0.1.Final

5.0.2.Final

5.0.3.Final

5.0.4.Final

5.0.5.Final

org.jboss.resteasy:resteasy-multipart-provider

Package

Name: org.jboss.resteasy:resteasy-multipart-provider; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-multipart-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0.Beta1

Fixed

4.7.8.Final

Affected versions

4.*

4.0.0.Beta1

4.0.0.Beta2

4.0.0.Beta3

4.0.0.Beta4

4.0.0.Beta5

4.0.0.Beta6

4.0.0.Beta7

4.0.0.Beta8

4.0.0.CR1

4.0.0.CR2

4.0.0.CR3

4.0.0.Final

4.1.0.Final

4.1.1.Final

4.2.0.Final

4.3.0.Final

4.3.1.Final

4.4.0.CR1

4.4.0.Final

4.4.1.Final

4.4.2.Final

4.4.3.Final

4.5.0.Final

4.5.1.Final

4.5.2.Final

4.5.3.Final

4.5.4.Final

4.5.5.Final

4.5.6.Final

4.5.7.Final

4.5.8.SP1

4.5.8.Final

4.5.9.Final

4.5.10.Final

4.5.11.Final

4.5.12.Beta1

4.5.12.Final

4.6.0.Final

4.6.1.Alpha1

4.6.1.Beta1

4.6.1.Beta2

4.6.1.Beta3

4.6.1.Beta5

4.6.1.Beta6

4.6.1.Beta7

4.6.1.Beta8

4.6.1.Beta9

4.6.1.Final

4.6.2.Final

4.7.0.Beta1

4.7.0.Beta2

4.7.0.Beta3

4.7.0.Beta6

4.7.0.Beta7

4.7.0.Final

4.7.1.Final

4.7.2.Final

4.7.3.Final

4.7.4.Final

4.7.5.Final

4.7.6.Final

4.7.7.Final

org.jboss.resteasy:resteasy-multipart-provider

Package

Name: org.jboss.resteasy:resteasy-multipart-provider; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-multipart-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.15.5.Final

Affected versions

1.*

1.0-beta-9

1.0-RC1

1.0.0.GA

1.0.1.GA

1.0.2.GA

1.1-RC1

1.1-RC2

1.1.GA

1.2.RC1

1.2.GA

1.2.1.GA

2.*

2.0-beta-1

2.0-beta-2

2.0-beta-3

2.0-beta-4

2.0-RC1

2.0.0.GA

2.0.1.GA

2.1-beta-1

2.1.0.GA

2.2-beta-1

2.2-RC-1

2.2.0.GA

2.2.1.GA

2.2.2.GA

2.2.3.GA

2.3-beta-1

2.3-RC1

2.3.0.GA

2.3.1.GA

2.3.2.Final

2.3.3.Final

2.3.4.Final

2.3.5.Final

2.3.6.Final

2.3.7.Final

2.3.10.Final

3.*

3.0-beta-1

3.0-beta-2

3.0-beta-3

3.0-beta-4

3.0-beta-5

3.0-beta-6

3.0-rc-1

3.0.0.Final

3.0.1.Final

3.0.2.Final

3.0.3.Final

3.0.4.Final

3.0.5.Final

3.0.6.Final

3.0.7.Final

3.0.8.Final

3.0.9.Final

3.0.10.Final

3.0.11.Final

3.0.12.Final

3.0.13.Final

3.0.14.Final

3.0.15.Final

3.0.16.Final

3.0.17.Final

3.0.18.Final

3.0.19.Final

3.0.20.Final

3.0.21.Final

3.0.22.Final

3.0.23.Final

3.0.24.Final

3.0.26.Final

3.1.0.Beta1

3.1.0.Beta2

3.1.0.CR1

3.1.0.CR2

3.1.0.CR3

3.1.0.Final

3.1.1.Final

3.1.2.Final

3.1.3.Final

3.1.4.Final

3.5.0.CR1

3.5.0.CR2

3.5.0.CR3

3.5.0.CR4

3.5.0.Final

3.5.1.Final

3.6.0.CR1

3.6.0.Final

3.6.1.SP1

3.6.1.SP2

3.6.1.SP3

3.6.1.SP5

3.6.1.SP6

3.6.1.SP7

3.6.1.SP8

3.6.1.Final

3.6.2.Final

3.6.3.SP1

3.6.3.Final

3.7.0.Final

3.8.0.Final

3.8.1.Final

3.9.0.Final

3.9.1.Final

3.9.2.Final

3.9.3.SP1

3.9.3.Final

3.10.0.Final

3.11.0.Final

3.11.1.Final

3.11.2.Final

3.11.3.Final

3.11.4.Final

3.11.5.Final

3.12.0.Final

3.12.1.Final

3.13.0.Final

3.13.1.Final

3.13.2.Final

3.14.0.Final

3.15.0.Alpha1

3.15.0.Final

3.15.1.Final

3.15.2.Final

3.15.3.Final

Database specific

last_known_affected_version_range

"< 3.15.4.Final"

org.jboss.resteasy:resteasy-core

Package

Name: org.jboss.resteasy:resteasy-core; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.resteasy/resteasy-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.15.5.Final

Database specific

last_known_affected_version_range

"< 3.15.4.Final"