CVE-2020-1695: fedoraproject fedora Improper Input Validation

Modified

AliasesMGASA-2021-0039RHSA-2021:1775UBUNTU-CVE-2020-1695+2 more

Published 19-05-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-1695 is a high (CVSS 7.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 2.02% chance of exploitation in the next 30 days, higher than 80.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.0 (CVE.org)

EPSS score

2.02%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 2

RHSA-2020:2511 RHSA-2020:2512 RHSA-2020:2513 RHSA-2020:3637 RHSA-2020:3638 RHSA-2020:3639+2 more

Timeline

19-05-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

CVSS metrics

9 scores · 6 sources · 3 versions

v3.17.5v3.07.5v2.05.0

EPSS trend

Probability

2.02%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.02% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat61 products

resteasy≥ 3.0.0, < 3.12.0 | ≥ 4.0.0, < 4.6.0
apache-commons-collections< 0:3.2.2-10.module+el8.1.0+3366+6dfb954c
apache-commons-lang< 0:2.6-21.module+el8.1.0+3366+6dfb954c
apache-commons-net< 0:3.6-3.module+el8.3.0+6805+72837426
bea-stax< 0:1.2.0-16.module+el8.1.0+3366+6dfb954c

bea-stax-api< 0:1.2.0-16.module+el8.1.0+3366+6dfb954c
glassfish-fastinfoset< 0:1.2.13-9.module+el8.1.0+3366+6dfb954c
glassfish-jaxb< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-api< 0:2.2.12-8.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-core< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-runtime< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-txw2< 0:2.2.11-11.module+el8.1.0+3366+6dfb954c
jackson-annotations< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-core< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-databind< 0:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-jaxrs-json-provider< 0:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-jaxrs-providers< 0:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-module-jaxb-annotations< 0:2.7.6-4.module+el8.1.0+3366+6dfb954c
jakarta-commons-httpclient< 1:3.1-28.module+el8.1.0+3366+6dfb954c
javassist< 0:3.18.1-8.module+el8.1.0+3366+6dfb954c
javassist-javadoc< 0:3.18.1-8.module+el8.1.0+3366+6dfb954c
jss< 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debuginfo< 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debugsource< 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-javadoc< 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
ldapjdk< 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
ldapjdk-javadoc< 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
pki-acme< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-base< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-base-java< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-ca< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-core< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-core-debuginfo< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-core-debugsource< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-kra< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-server< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-servlet-4.0-api< 1:9.0.30-1.module+el8.3.0+6730+8f9c6254
pki-servlet-engine< 1:9.0.30-1.module+el8.3.0+6730+8f9c6254
pki-symkey< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-symkey-debuginfo< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-tools< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
pki-tools-debuginfo< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
python-nss< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python-nss-debugsource< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python-nss-doc< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-nss< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-nss-debuginfo< 0:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-pki< 0:10.10.5-2.module+el8.4.0+10466+9830f79e
relaxngDatatype< 0:2011.1-7.module+el8.1.0+3366+6dfb954c
resteasy< 0:3.0.26-6.module+el8.4.0+8891+bb8828ef
slf4j< 0:1.7.25-4.module+el8.1.0+3366+6dfb954c
slf4j-jdk14< 0:1.7.25-4.module+el8.1.0+3366+6dfb954c
stax-ex< 0:1.7.7-8.module+el8.2.0+5723+4574fbff
tomcatjss< 0:7.6.1-1.module+el8.4.0+8778+d07929ff
velocity< 0:1.7-24.module+el8.1.0+3366+6dfb954c
xalan-j2< 0:2.7.1-38.module+el8.1.0+3366+6dfb954c
xerces-j2< 0:2.11.0-34.module+el8.1.0+3366+6dfb954c
xml-commons-apis< 0:1.4.01-25.module+el8.1.0+3366+6dfb954c
xml-commons-resolver< 0:1.2-26.module+el8.1.0+3366+6dfb954c
xmlstreambuffer< 0:1.5.4-8.module+el8.2.0+5723+4574fbff
xsom< 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c

Show all 61

Ubuntu2 products

resteasy< 3.0.6-3ubuntu0.1~esm1 | < 3.6.2-2ubuntu0.20.04.1~esm1 | < 3.6.2-2ubuntu0.22.04.1~esm1 | < 3.6.2-2ubuntu0.24.04.1~esm1 | All versions (No fix recorded)
resteasy3.0< 3.0.26-1~18.04.1~esm1 | < 3.0.26-1ubuntu0.1~esm1

Debian1 product

resteasy3.0< 3.0.26-2

Fedoraproject1 product

fedoraEOL32 | 33

Mageia1 product

resteasy< 3.0.26-2.mga7

Org.jboss.resteasy1 product

resteasy-client≥ 4.0.0, < 4.6.0 | ≥ 3.0.0, < 3.12.0

Red hat1 product

resteasyall resteasy 3.x.x versions prior to 3.12.0.Final | all resteasy 4.x.x versions prior to 4.6.0.Final

7 vendors · 68 products

References

42 links

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695X Refsource CONFIRMWEBIssue TrackingPatchVendor Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
advisories.mageia.org/MGASA-2021-0039.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=27794REPORT
lists.fedoraproject.org/archives/…WEB
access.redhat.com/errata/RHSA-2021:1775Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1584550REPORT

Show all 42 references