{"id":"CVE-2016-7050","aliases":["EUVD-2016-7931","GHSA-m2g5-gpqx-rwvw","MGASA-2016-0382","RHSA-2016:2604","UBUNTU-CVE-2016-7050","USN-7630-1"],"status":"published","title":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux...","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05309,"percentile":0.92646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2016-11-17T16:37:05Z","modified":"2026-08-05T10:04:09Z","fixes":[{"ecosystem":"Mageia:5","package":"resteasy","fixed_in":["3.0.6-3.1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-atom-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-client","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jackson-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-javadoc","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxb-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-all","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-api","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jettison-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-providers-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-resteasy-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-tjws","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-atom-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-client","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jackson-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-javadoc","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxb-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-all","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-api","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jettison-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-providers-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-resteasy-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-tjws","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-atom-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-client","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jackson-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-javadoc","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxb-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-all","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-api","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jettison-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-providers-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-resteasy-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-tjws","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-javadoc","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-all","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-providers-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-resteasy-pom","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-tjws","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-atom-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-client","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jackson-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxb-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-api","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jettison-provider","fixed_in":["0:3.0.6-4.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","fixed_in":["3.0.6-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-3.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-resteasy-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-resteasy-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-resteasy-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-providers-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-resteasy-pom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-tjws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jaxrs-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"resteasy-base-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-4.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-3ubuntu0.1~esm1"}]}],"versions":["3.0.6-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-3ubuntu0.1~esm1"}]}],"versions":["3.0.6-3"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1~18.04.1~esm1"}]}],"versions":["3.0.19-1","3.0.19-2","3.0.26-1~18.04"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1ubuntu0.1~esm1"}]}],"versions":["3.0.26-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-3ubuntu0.1"}]}],"versions":["3.0.26-2","3.0.26-3"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6ubuntu0.24.04.1"}]}],"versions":["3.0.26-6"],"bundled":11}],"products":[{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2604.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1378613","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","VDB Entry","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7050","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m2g5-gpqx-rwvw"},{"url":"https://advisories.mageia.org/MGASA-2016-0382.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19718","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-2604.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2604","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1280539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357624","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2604.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7050","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2016-7050","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7630-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-6345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9622","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7050","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","status":"published","published":"2017-06-08T19:00:00Z","modified":"2024-08-06T01:50:47.432Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-7931","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","status":"published","published":"2017-06-08T19:00:00Z","modified":"2024-08-06T01:50:47Z","updated_at":"2026-11-03T02:22:34.587517Z"}],"ghsa":[{"id":"GHSA-m2g5-gpqx-rwvw","title":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux...","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","status":"published","published":"2022-05-17T02:41:03Z","modified":"2023-01-27T05:05:27Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:42:41.939038Z"}],"nvd":[{"id":"CVE-2016-7050","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","status":"published","published":"2017-06-08T19:29:00.37Z","modified":"2026-06-17T00:52:13.2Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:38.290327Z"}],"osv":[{"id":"RHSA-2016:2604","title":"Red Hat Security Advisory: resteasy-base security and bug fix update","status":"published","published":"2024-09-15T23:33:31Z","modified":"2026-08-05T10:04:09Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-7050","description":"SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.","status":"published","published":"2017-06-08T19:29:00Z","modified":"2026-02-04T03:29:20.715479Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"MGASA-2016-0382","title":"Updated resteasy packages fix security vulnerability","description":"It was discovered that under certain conditions RESTEasy could be forced\nto parse a request with SerializableProvider, resulting in\ndeserialization of potentially untrusted data. An attacker could\npossibly use this flaw to execute arbitrary code with the permissions of\nthe application using RESTEasy (CVE-2016-7050).\n","status":"published","published":"2016-11-17T16:37:05Z","modified":"2026-04-16T06:24:59.727048863Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-7630-1","title":"resteasy, resteasy3.0 vulnerabilities","description":"It was discovered that RESTEasy made insufficient use of random values in\nasynchronous jobs. An attacker could possibly use this issue to steal\nuser data. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6345)\n\nIt was discovered that RESTEasy enabled a vulnerable GZIP decompression\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-6346)\n\nIt was discovered that RESTEasy improperly made use of unsanitized data\nwhile handling certain errors. An attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6347)\n\nIt was discovered that RESTEasy enabled a vulnerable JSON manipulation\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6348)\n\nIt was discovered that RESTEasy enabled a vulnerable deserialization\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-7050)\n\nNikos Papadopoulos discovered that RESTEasy improperly handled URL encoding\nwhen certain errors occur. An attacker could possibly use this issue to\nmodify the app's behavior for other users throughout the network.\nThis issue did not affect resteasy3.0 in Ubuntu 24.04 LTS, Ubuntu 24.10,\nand Ubuntu 25.04. (CVE-2020-10688)\n\nMirko Selber discovered that RESTEasy improperly validated user input\nduring HTTP response construction. An attacker could possibly use this\nissue to to cause a denial of service or execute arbitrary code.\nThis issue did not affect resteasy3.0 in Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2020-1695)\n\nIt was discovered that RESTEasy improperly handled receiving the\nWebApplicationException during a client call. An attacker could possibly\nuse this issue to obtain potentially sensitive server information.\n(CVE-2020-25633)\n\nIt was discovered that RESTEasy improperly populated exception responses\nwith endpoint class and method names. An attacker could possibly use this\nissue to obtain potentially sensitive server information. (CVE-2021-20289)\n\nIt was discovered that RESTEasy used improper permissions when creating\ntemporary files. An attacker could possibly use this issue to get access to\nsensitive data. (CVE-2023-0482)\n\nIt was discovered that RESTEasy improperly handled certain HTTP requests\ncontaining ASCII control characters. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-9622)","status":"published","published":"2025-07-10T14:30:24Z","modified":"2026-06-25T13:32:30.622146855Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}