The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2604 advisory.

    RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful     Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

    Security Fix(es):

    * It was discovered that under certain conditions RESTEasy could be forced to parse a request with     SerializableProvider, resulting in deserialization of potentially untrusted data. An attacker could     possibly use this flaw to execute arbitrary code with the permissions of the application using RESTEasy.
    (CVE-2016-7050)

    Red Hat would like to thank Mikhail Egorov (Odin) for reporting this issue.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : resteasy-base (RHSA-2016:2604)

critical Nessus Plugin ID 94567

Version 2.15