Skip to content
Fencer Vulns
medium 5.3

CVE-2020-25633 json

Generation of Error Message Containing Sensitive Information in RESTEasy client

published 2020-09-18 6 y ago modified 2026-06-17 4 mo ago also GHSA-hr32-mgpm-qf2f , EUVD-2021-1336

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

Patch / fix

  • maven org.jboss.resteasy:resteasy-client 3.14.0.Final, 4.5.7.Final
  • maven org.jboss.resteasy:resteasy-client-microprofile 3.14.0.Final, 4.5.7.Final
  • redhat resteasy 3.14.0
  • resteasy3.0 Ubuntu 22.04 LTS 3.0.26-3ubuntu0.1
  • resteasy3.0 Ubuntu 24.04 LTS 3.0.26-6ubuntu0.24.04.1
  • resteasy Ubuntu Pro 16.04 LTS 3.0.6-3ubuntu0.1~esm1
  • resteasy Ubuntu Pro 20.04 LTS 3.6.2-2ubuntu0.20.04.1~esm1
  • resteasy Ubuntu Pro 22.04 LTS 3.6.2-2ubuntu0.22.04.1~esm1
  • resteasy Ubuntu Pro 24.04 LTS 3.6.2-2ubuntu0.24.04.1~esm1
  • resteasy3.0 Ubuntu Pro 18.04 LTS 3.0.26-1~18.04.1~esm1
  • resteasy3.0 Ubuntu Pro 20.04 LTS 3.0.26-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2020-25633

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-wildfly jboss enterprise application platform 7.3 7.3.5-2.GA_redhat_00001.1.el8eap
  • eap7-narayana jboss enterprise application platform 7.3 5.9.10-1.Final_redhat_00001.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.3 3.11.3-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.33-1.SP2_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.3 5.3.20-1.Final_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.3 3.2.12-1.Final_redhat_00001.1.el8eap
  • eap7-resteasy-cdi jboss enterprise application platform 7.3 3.11.3-1.Final_redhat_00001.1.el8eap
  • eap7-glassfish-jsf jboss enterprise application platform 7.3 2.3.9-12.SP13_redhat_00001.1.el8eap

red hat advisories RHSA-2021:0248RHSA-2021:0247RHSA-2021:0246RHSA-2021:1313

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25633 updated cvss 5.3

resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

  • Red Hat build of Quarkus resteasy-client
    affected: no fix available
  • Red Hat Enterprise Linux 7 resteasy-base, resteasy-base-tjws, resteasy-base-jaxrs, resteasy-base-client, resteasy-base-javadoc, resteasy-base-jaxrs-all, +7 more Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat Integration Service Registry resteasy-client
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Data Grid 7 resteasy-client Red Hat JBoss Enterprise Application Platform Continuous Delivery resteasy-client Red Hat JBoss Fuse 6 resteasy-client
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes resteasy-client Red Hat Single Sign-On 7 resteasy-client
    affected: no fix available
  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el8eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el8eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el8eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el8eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el8eap, +90 more
    fixed: vendor fix RHSA-2021:0248
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el6eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el6eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el6eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el6eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el6eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el6eap, +90 more
    fixed: vendor fix RHSA-2021:0246
show 7 more
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wildfly 7.3.5-2.GA_redhat_00001.1.el7eap, eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el7eap, eap7-narayana 5.9.10-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.11.3-1.Final_redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-7.redhat_00017.1.el7eap, eap7-hibernate 5.3.20-1.Final_redhat_00001.1.el7eap, +92 more
    fixed: vendor fix RHSA-2021:0247
  • Red Hat JBoss Enterprise Application Platform resteasy-client 3.15.1.Final-redhat-00001
    fixed: vendor fix RHSA-2021:2858
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:0250
  • Red Hat Satellite 6.9 candlepin 3.1.26-1.el7sat, candlepin-selinux 3.1.26-1.el7sat
    fixed: vendor fix RHSA-2021:1313
  • Red Hat Single Sign-On 7.4.5
    fixed: vendor fix RHSA-2021:0327
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2021:0295
  • Red Hat A-MQ Clients 2 resteasy-client Red Hat Data Grid 8 resteasy-client Red Hat Decision Manager 7 resteasy-client Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1444 more Red Hat Process Automation 7 resteasy-client Red Hat Satellite 6.9 tfm 6.1-4.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.5-2.el7sat, gofer 2.12.5-7.el7sat, libsolv 0.7.12-2.el7pc, receptor 0.6.3-1.el7ar, +637 more
    +1 more products
    Red Hat Satellite Capsule 6.9 tfm 6.1-4.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.5-2.el7sat, gofer 2.12.5-7.el7sat, libsolv 0.7.12-2.el7pc, future 0.16.0-11.el7sat, +238 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jboss.resteasy:resteasy-client
>=4.0.0, <4.5.7.Final
<3.14.0.Final
4.5.7.Final
3.14.0.Final
maven org.jboss.resteasy:resteasy-client-microprofile
>=4.0.0, <4.5.7.Final
<3.14.0.Final
4.5.7.Final
3.14.0.Final

Affected products

  • Red Hat resteasy-client

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.