CVE-2020-1695: 
Java vulnerability analysis and mitigation

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This vulnerability was discovered in 2019 and was assigned CVE-2020-1695 (CVE Mitre, NVD).

The vulnerability stems from an improper input validation in the MediaTypeHeaderDelegate.java class, which results in the class returning an illegal header that will be then integrated into the server's response. The issue was fixed in resteasy versions 3.12.0.Final and 4.6.0.Final through a security patch (Red Hat Bugzilla, GitHub Commit).

This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed (Debian Tracker).

The vulnerability was discovered by security researcher Mirko Selber from Compass Security (Red Hat Bugzilla).

Users are advised to upgrade to resteasy version 3.12.0.Final or 4.6.0.Final, depending on their current version. Multiple vendors have released security updates to address this vulnerability, including Red Hat through various security advisories for affected products (Red Hat Advisory).