PT-2015-4552 · Apache · Apache Camel

Stephan Siano · Publicado 2015-06-03 · Atualizado 2019-05-24 · CVE-2015-0264

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.13.4 Apache Camel versions 2.14.x prior to 2.14.2

Description The issue allows remote attackers to read arbitrary files via an external entity in an invalid XML String or GenericFile object in an XPath query. This is due to multiple XML external entity (XXE) vulnerabilities in the builder/xml/XPathBuilder.java file.

Recommendations For Apache Camel versions prior to 2.13.4, update to version 2.13.4 or later. For Apache Camel versions 2.14.x prior to 2.14.2, update to version 2.14.2 or later. As a temporary workaround, consider restricting the use of external entities in XPath queries until a patch is available.

Correção

Identificadores relacionados

CVE-2015-0264

GHSA-MHX2-R3JX-G94C

Produtos afetados

Apache Camel

Referências · 18

• https://github.com/apache/camel · Nota
• https://github.com/apache/camel/commit/7360aada5154434c68774aa30e0f21ddc5f27b9f · Nota
• https://github.com/apache/camel/commit/b47b51a195b38e7ab7c099d19910af70a16638f6 · Nota
• https://github.com/advisories/GHSA-mhx2-r3jx-g94c · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1539.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1041.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-mhx2-r3jx-g94c · Aviso do Fabricante
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Nota
• https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=1df559649a96a1ca0368373387e542f46e4820da · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1538.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E · Nota
• https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc · Aviso do Fabricante
• https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0264 · Nota de Segurança