CVE-2020-25633: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in RESTEasy client affecting all versions up to 4.5.6.Final. The vulnerability, identified as CVE-2020-25633, was disclosed on September 18, 2020. This security flaw impacts the RESTEasy client component, potentially exposing sensitive server information when the server encounters a WebApplicationException during RESTEasy client calls (NVD, Red Hat).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). The flaw specifically manifests when handling WebApplicationException responses in the RESTEasy client implementation (NVD).

The primary impact of this vulnerability is on data confidentiality. When exploited, it allows client users to obtain potentially sensitive server information through error messages, including details that might be exposed in headers, cookies, and response bodies when the server encounters a WebApplicationException (Red Hat).

The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), indicating the vulnerability can be exploited without impacting resources beyond the vulnerable component (NVD).

The vulnerability has been fixed in RESTEasy versions 3.11.3, 4.6.0, 3.14.0, 4.4.3, and 3.5.9. Users are advised to upgrade to these or later versions to address the security issue. Red Hat has released several security advisories (RHSA-2021:0246, RHSA-2021:0247, RHSA-2021:0248, RHSA-2021:0250) to address this vulnerability in affected products (Debian).