RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality
Published Sep 7, 2016
6.5
MEDIUMCVSS 3.0
EPSS 1.77%
Description
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.
Affected products
No data.
No data.
Red Hat BPM Suite 6
resteasy
Will not fix
Red Hat Enterprise Linux 7
resteasy-base
Fix deferred
Red Hat Enterprise Virtualization 3
vdsm-jsonrpc-java
Under investigation
Red Hat JBoss BRMS 5
security
Will not fix
Red Hat JBoss BRMS 6
resteasy
Will not fix
Red Hat JBoss Data Grid 6
build
Not affected
Red Hat JBoss Data Grid 7
resteasy
Affected
Red Hat JBoss Data Virtualization 6
resteasy
Will not fix
Red Hat JBoss Enterprise Application Platform 5
jbossas
Will not fix
Red Hat JBoss Enterprise Application Platform 6
resteasy
Will not fix
Red Hat JBoss Enterprise Application Platform 7
rest
Will not fix
Red Hat JBoss Fuse 6
SwitchYard
Will not fix
Red Hat JBoss Fuse Service Works 6
resteasy
Will not fix
Red Hat JBoss Operations Network 3
rest
Will not fix
Red Hat JBoss Portal 6
Requirements
Not affected
Red Hat JBoss SOA Platform 5
security
Will not fix
Red Hat Satellite 6
Security
Not affected
Red Hat Single Sign-On 7
core
Not affected
Red Hat Subscription Asset Manager
katello
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat BPM Suite 6 | resteasy | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | resteasy-base | Fix deferred | n/a |
| Red Hat Enterprise Virtualization 3 | vdsm-jsonrpc-java | Under investigation | n/a |
| Red Hat JBoss BRMS 5 | security | Will not fix | n/a |
| Red Hat JBoss BRMS 6 | resteasy | Will not fix | n/a |
| Red Hat JBoss Data Grid 6 | build | Not affected | n/a |
| Red Hat JBoss Data Grid 7 | resteasy | Affected | n/a |
| Red Hat JBoss Data Virtualization 6 | resteasy | Will not fix | n/a |
| Red Hat JBoss Enterprise Application Platform 5 | jbossas | Will not fix | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | resteasy | Will not fix | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | rest | Will not fix | n/a |
| Red Hat JBoss Fuse 6 | SwitchYard | Will not fix | n/a |
| Red Hat JBoss Fuse Service Works 6 | resteasy | Will not fix | n/a |
| Red Hat JBoss Operations Network 3 | rest | Will not fix | n/a |
| Red Hat JBoss Portal 6 | Requirements | Not affected | n/a |
| Red Hat JBoss SOA Platform 5 | security | Will not fix | n/a |
| Red Hat Satellite 6 | Security | Not affected | n/a |
| Red Hat Single Sign-On 7 | core | Not affected | n/a |
| Red Hat Subscription Asset Manager | katello | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Don't enable Async Jobs Service as details in the section, "2.10. RESTEASY ASYNCHRONOUS JOB SERVICE" of JBoss EAP 7 Developing Web Services Applications documentation: https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/7.0/paged/developing-web-services-applications/chapter-2-developing-jax-rs-web-services
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1 other source (Red Hat) ▾
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
AV:N/AC:L/Au:S/C:P/I:N/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (10 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.77% (0.01772) | 77.34th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.50% (0.01497) | 70.76th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.15% (0.00147) | 32.65th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.11% (0.00114) | 46.64th | v3 (v2023.03.01) |
| Jul 10, 2024 | 0.11% (0.00114) | 45.39th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.11% (0.00114) | 43.33th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.05% (0.01055) | 52.13th | v2 (v2022.01.01) |
| Sep 17, 2022 | 1.05% (0.01055) | 50.47th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.05% (0.01055) | 48.43th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.05% (0.01055) | 27.52th | v2 (v2022.01.01) |
References (6)
- http://www.securityfocus.com/bid/92746 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2016-6345 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1372117 x_refsource_CONFIRMIssue Tracking
- https://github.com/advisories/GHSA-vxhj-3x7p-jxp5 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-6345
- https://www.cve.org/CVERecord?id=CVE-2016-6345
| Link | Providers | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92746 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/security/cve/CVE-2016-6345 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1372117 | x_refsource_CONFIRMIssue Tracking | |
| https://github.com/advisories/GHSA-vxhj-3x7p-jxp5 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2016-6345 | ||
| https://www.cve.org/CVERecord?id=CVE-2016-6345 |
Change history (0)
No recorded changes yet.