CVE-2020-25724

Name	CVE-2020-25724
Description	A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
resteasy (PTS)	sid	3.6.2-2	vulnerable
resteasy3.0 (PTS)	buster	3.0.26-1	vulnerable
	bullseye	3.0.26-2	vulnerable
	bookworm, sid	3.0.26-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
resteasy	source	(unstable)	(unfixed)
resteasy3.0	source	(unstable)	(unfixed)

Notes

[bullseye] - resteasy3.0 <no-dsa> (Minor issue)
[buster] - resteasy3.0 <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1899354 (lacks details ATM)