3490.yaml

cve: 2014-3490
title: "RESTEasy: XXE via parameter entities"
cvss_v2: 5.0
references:
    - https://bugzilla.redhat.com/CVE-2014-3490
affected:
    - groupId: "org.jboss.resteasy"
      artifactId: "resteasy-jaxb-provider"
      version:
        - ">=1.2.1-10.CP02_patch01,1.2.1-"
        - ">=2.2.1-1,2.2.1-"
        - ">=2.3.2.Final,2"
        - "<=3.0.8.Final,3"
      fixedin:
        - ">=3.0.9.Final,3"
        - ">=2.3.8.SP2,2.3"
        - ">=2.3.8.SP1-redhat-1,2.3.8.SP1-redhat-"
package_urls:
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.19.Final-redhat-1/resteasy-jaxb-provider-2.3.19.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.7.Final/resteasy-jaxb-provider-3.0.7.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.12.Final-redhat-1/resteasy-jaxb-provider-2.3.12.Final-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-5/resteasy-jaxb-provider-3.0-beta-5.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.10.Final/resteasy-jaxb-provider-2.3.10.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.4.Final/resteasy-jaxb-provider-3.0.4.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.17.Final-redhat-1/resteasy-jaxb-provider-2.3.17.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.0.Final/resteasy-jaxb-provider-3.0.0.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.5.Final/resteasy-jaxb-provider-2.3.5.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.1.Final/resteasy-jaxb-provider-3.0.1.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.10.Final-redhat-1/resteasy-jaxb-provider-2.3.10.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.3.Final/resteasy-jaxb-provider-3.0.3.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.13.Final-redhat-1/resteasy-jaxb-provider-2.3.13.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.5.Final/resteasy-jaxb-provider-3.0.5.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.8.SP2-redhat-3/resteasy-jaxb-provider-2.3.8.SP2-redhat-3.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-6/resteasy-jaxb-provider-3.0-beta-6.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.3.Final-redhat-1/resteasy-jaxb-provider-2.3.3.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-2/resteasy-jaxb-provider-3.0-beta-2.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.7.Final-redhat-2/resteasy-jaxb-provider-2.3.7.Final-redhat-2.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.0.Final/resteasy-jaxb-provider-3.0.0.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.15.Final-redhat-1/resteasy-jaxb-provider-2.3.15.Final-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.1.Final/resteasy-jaxb-provider-3.0.1.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.5.Final/resteasy-jaxb-provider-2.3.5.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.7.Final/resteasy-jaxb-provider-3.0.7.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.6.Final/resteasy-jaxb-provider-2.3.6.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-4/resteasy-jaxb-provider-3.0-beta-4.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.8.Final-redhat-3/resteasy-jaxb-provider-2.3.8.Final-redhat-3.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-1/resteasy-jaxb-provider-3.0-beta-1.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.16.Final-redhat-1/resteasy-jaxb-provider-2.3.16.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-4/resteasy-jaxb-provider-3.0-beta-4.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.4.Final-redhat-2/resteasy-jaxb-provider-2.3.4.Final-redhat-2.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.2.Final/resteasy-jaxb-provider-3.0.2.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.8.SP4-redhat-2/resteasy-jaxb-provider-2.3.8.SP4-redhat-2.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-6/resteasy-jaxb-provider-3.0-beta-6.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.8.SP3-redhat-2/resteasy-jaxb-provider-2.3.8.SP3-redhat-2.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.3.Final/resteasy-jaxb-provider-3.0.3.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.6.Final-redhat-1/resteasy-jaxb-provider-2.3.6.Final-redhat-1.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-rc-1/resteasy-jaxb-provider-3.0-rc-1.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.7.1.Final-redhat-1/resteasy-jaxb-provider-2.3.7.1.Final-redhat-1.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.7.2.Final-redhat-1/resteasy-jaxb-provider-2.3.7.2.Final-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.6.Final/resteasy-jaxb-provider-3.0.6.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.22.Final-redhat-1/resteasy-jaxb-provider-2.3.22.Final-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.2.Final/resteasy-jaxb-provider-3.0.2.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.10.Final/resteasy-jaxb-provider-2.3.10.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.4.Final/resteasy-jaxb-provider-2.3.4.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-5/resteasy-jaxb-provider-3.0-beta-5.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.6.Final/resteasy-jaxb-provider-2.3.6.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.4.Final/resteasy-jaxb-provider-3.0.4.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.3.Final/resteasy-jaxb-provider-2.3.3.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-1/resteasy-jaxb-provider-3.0-beta-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-2/resteasy-jaxb-provider-3.0-beta-2.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.3.7.Final/resteasy-jaxb-provider-2.3.7.Final.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.20.Final-redhat-1/resteasy-jaxb-provider-2.3.20.Final-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.5.Final/resteasy-jaxb-provider-3.0.5.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.4.Final/resteasy-jaxb-provider-2.3.4.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.3.Final/resteasy-jaxb-provider-2.3.3.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-3/resteasy-jaxb-provider-3.0-beta-3.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.2.3.GA/resteasy-jaxb-provider-2.2.3.GA.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.8.Final/resteasy-jaxb-provider-3.0.8.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.2.3.GA/resteasy-jaxb-provider-2.2.3.GA.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/3.0.6.Final/resteasy-jaxb-provider-3.0.6.Final.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.2.2.GA/resteasy-jaxb-provider-2.2.2.GA.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-rc-1/resteasy-jaxb-provider-3.0-rc-1.jar
    - https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-jaxb-provider/2.3.8.SP2-redhat-1/resteasy-jaxb-provider-2.3.8.SP2-redhat-1.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0.8.Final/resteasy-jaxb-provider-3.0.8.Final.jar
    - http://central.maven.org/maven2/org/jboss/resteasy/resteasy-jaxb-provider/2.2.2.GA/resteasy-jaxb-provider-2.2.2.GA.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/3.0-beta-3/resteasy-jaxb-provider-3.0-beta-3.jar
    - https://repository.jboss.org/nexus/content/repositories/releases/org/jboss/resteasy/resteasy-jaxb-provider/2.3.7.Final/resteasy-jaxb-provider-2.3.7.Final.jar