CVE-2023-0482 json
Insecure Temporary File in RESTEasy
published 2023-02-17 3 y ago modified 2026-06-17 4 mo ago also GHSA-2c6g-pfx3-w7h8 , EUVD-2025-0086
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Patch / fix
- maven org.jboss.resteasy:resteasy-core 3.15.5.Final, 4.7.8.Final, 5.0.6.Final, 6.2.3.Final
- maven org.jboss.resteasy:resteasy-multipart-provider 3.15.5.Final, 4.7.8.Final, 5.0.6.Final, 6.2.3.Final
- resteasy3.0 Ubuntu 22.04 LTS 3.0.26-3ubuntu0.1
- resteasy3.0 Ubuntu 24.04 LTS 3.0.26-6ubuntu0.24.04.1
- resteasy Ubuntu Pro 16.04 LTS 3.0.6-3ubuntu0.1~esm1
- resteasy Ubuntu Pro 20.04 LTS 3.6.2-2ubuntu0.20.04.1~esm1
- resteasy Ubuntu Pro 22.04 LTS 3.6.2-2ubuntu0.22.04.1~esm1
- resteasy Ubuntu Pro 24.04 LTS 3.6.2-2ubuntu0.24.04.1~esm1
- resteasy3.0 Ubuntu Pro 18.04 LTS 3.0.26-1~18.04.1~esm1
- resteasy3.0 Ubuntu Pro 20.04 LTS 3.0.26-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2023-0482
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap7-netty jboss enterprise application platform 7.4 4.1.86-1.Final_redhat_00001.1.el9eap
- eap7-wildfly jboss enterprise application platform 7.4 7.4.10-6.GA_redhat_00002.1.el9eap
- eap7-resteasy jboss enterprise application platform 7.4 3.15.5-1.Final_redhat_00001.1.el9eap
- eap7-undertow jboss enterprise application platform 7.4 2.2.23-1.SP2_redhat_00001.1.el9eap
- eap7-snakeyaml jboss enterprise application platform 7.4 1.33.0-2.SP1_redhat_00001.1.el9eap
- eap7-infinispan jboss enterprise application platform 7.4 11.0.17-1.Final_redhat_00001.1.el9eap
- eap7-ironjacamar jboss enterprise application platform 7.4 1.5.11-1.Final_redhat_00001.1.el9eap
- eap7-jbossws-cxf jboss enterprise application platform 7.4 5.4.8-1.Final_redhat_00001.1.el9eap
red hat advisories RHSA-2023:1514RHSA-2023:1513RHSA-2023:1512RHSA-2023:2707RHSA-2023:2706RHSA-2023:2705
- github.com/resteasy/resteasy#3409 commit
- github.com/resteasy/resteasy#3409 pull request
- github.com/resteasy/resteasy#3410 pull request
- github.com/resteasy/resteasy#3412 pull request
- github.com/resteasy/resteasy#3413 pull request
- github.com/resteasy/resteasy#3423 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-0482 updated cvss 5.3
RESTEasy: creation of insecure temp files
-
Red Hat A-MQ Clients 2 resteasyaffected: no fix available “Fix deferred”
-
Red Hat Migration Toolkit for Runtimes org.keycloak-keycloak-parentaffected: no fix available
-
Red Hat A-MQ Online resteasyaffected: no fix available “Fix deferred”
-
Red Hat build of Apicurio Registry 2 resteasyaffected: no fix available
-
Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Fuse 7 resteasyaffected: no fix available “Fix deferred”
-
Red Hat JBoss Data Grid 7 resteasy Red Hat JBoss Enterprise Application Platform 6 resteasyaffected: no fix planned “Out of support scope”
-
Red Hat JBoss Enterprise Application Platform Expansion Pack resteasy Red Hat support for Spring Boot resteasyaffected: no fix available
-
Red Hat AMQ Broker 7.10.3fixed: vendor fix RHSA-2023:3185
show 14 moreshow fewer
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-22fixed: vendor fix RHSA-2023:2710
-
Red Hat MTA 6.1 for RHEL 8 mta/mta-ui-rhel8 6.1.4-2, mta/mta-hub-rhel8 6.1.4-2, mta/mta-rhel8-operator 6.1.4-3, mta/mta-operator-bundle 6.1.4-3, mta/mta-pathfinder-rhel8 6.1.4-1, mta/mta-windup-addon-rhel8 6.1.4-2fixed: vendor fix RHSA-2023:6305
-
Red Hat AMQ Streams 2.5.0fixed: vendor fix RHSA-2023:5165
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-resteasy 3.15.5-1.Final_redhat_00001.1.el7eap, eap7-resteasy-cdi 3.15.5-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jaxrs 3.15.5-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jsapi 3.15.5-1.Final_redhat_00001.1.el7eap, eap7-resteasy-client 3.15.5-1.Final_redhat_00001.1.el7eap, eap7-resteasy-crypto 3.15.5-1.Final_redhat_00001.1.el7eap, +13 morefixed: vendor fix RHSA-2023:1512
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-resteasy 3.15.5-1.Final_redhat_00001.1.el8eap, eap7-resteasy-cdi 3.15.5-1.Final_redhat_00001.1.el8eap, eap7-resteasy-jaxrs 3.15.5-1.Final_redhat_00001.1.el8eap, eap7-resteasy-jsapi 3.15.5-1.Final_redhat_00001.1.el8eap, eap7-resteasy-client 3.15.5-1.Final_redhat_00001.1.el8eap, eap7-resteasy-crypto 3.15.5-1.Final_redhat_00001.1.el8eap, +13 morefixed: vendor fix RHSA-2023:1513
-
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-resteasy 3.15.5-1.Final_redhat_00001.1.el9eap, eap7-resteasy-cdi 3.15.5-1.Final_redhat_00001.1.el9eap, eap7-resteasy-jaxrs 3.15.5-1.Final_redhat_00001.1.el9eap, eap7-resteasy-jsapi 3.15.5-1.Final_redhat_00001.1.el9eap, eap7-resteasy-client 3.15.5-1.Final_redhat_00001.1.el9eap, eap7-resteasy-crypto 3.15.5-1.Final_redhat_00001.1.el9eap, +13 morefixed: vendor fix RHSA-2023:1514
-
Red Hat JBoss Enterprise Application Platform resteasy-client 3.15.5.Final-redhat-00001fixed: vendor fix RHSA-2023:1516
-
Red Hat Single Sign-On 7fixed: vendor fix RHSA-2023:2713
-
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el7ssofixed: vendor fix RHSA-2023:2705
-
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el8ssofixed: vendor fix RHSA-2023:2706
-
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.7-1.redhat_00001.1.el9ssofixed: vendor fix RHSA-2023:2707
-
Red Hat RHPAM 7.13.4 asyncfixed: vendor fix RHSA-2023:4983
-
Red Hat RHPAM 7.13.5 asyncfixed: vendor fix RHSA-2024:1353
-
Red Hat build of Quarkus resteasy-core Red Hat Data Grid 8 resteasy Red Hat Integration Camel K 1 resteasy Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el7eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el7eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el7eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el7eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7eap, +81 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el8eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el8eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el8eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el8eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el8eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8eap, +82 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el9eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el9eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el9eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el9eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el9eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9eap, +81 morenot affected: vulnerable code not present
+1 more productsfewer
Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1541 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jboss.resteasy:resteasy-core | >=6.0.0.Beta1, <6.2.3.Final >=5.0.0.Alpha1, <5.0.6.Final >=4.0.0.Beta1, <4.7.8.Final <3.15.5.Final |
6.2.3.Final 5.0.6.Final 4.7.8.Final 3.15.5.Final |
| maven | org.jboss.resteasy:resteasy-multipart-provider | >=6.0.0.Beta1, <6.2.3.Final >=5.0.0.Alpha1, <5.0.6.Final >=4.0.0.Beta1, <4.7.8.Final <3.15.5.Final |
6.2.3.Final 5.0.6.Final 4.7.8.Final 3.15.5.Final |
Affected products
- n/a RESTEasy
Classification
- Weakness
-
- CWE-378 Creation of Temporary File With Insecure Permissions
References
-
github.com
/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56
web, patch
-
github.com
/resteasy/resteasy/pull/3409
web
-
github.com
/resteasy/resteasy/pull/3410
web
-
github.com
/resteasy/resteasy/pull/3412
web
-
github.com
/resteasy/resteasy/pull/3413
web
-
github.com
/resteasy/resteasy/pull/3423
web
-
security.netapp.com
/advisory/ntap-20230427-0001/
third-party-advisory
-
github.com
/resteasy/resteasy/security/advisories/GHSA-2c6g-pfx3-w7h8
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-0482
advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2166004
web
-
github.com
/orgs/resteasy/discussions/3415
web
-
github.com
/orgs/resteasy/discussions/3504
web
-
github.com
/orgs/resteasy/discussions/3506
web
-
github.com
/resteasy/resteasy
package
-
issues.redhat.com
/browse/RESTEASY-3286
web
-
security.netapp.com
/advisory/ntap-20230427-0001
web
Sources
- CVE List CVE-2023-0482
- GitHub Advisory GHSA-2c6g-pfx3-w7h8
- NVD CVE-2023-0482
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.