CVE-2016-9606

Name of the Vulnerable Software and Affected Versions RESTEasy versions prior to 3.1.2

Description The issue is related to insufficient input validation in the YamlProvider component, which could allow an attacker to execute arbitrary code with RESTEasy application permissions by forcing the application into parsing a request with YamlProvider, resulting in the unmarshalling of potentially untrusted data.

Recommendations For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the YamlProvider component until a patch is available. Restrict access to the YamlProvider component to minimize the risk of exploitation.