PT-2014-3427 · Apache · Apache Camel

Published 2014-03-20 · Updated 2023-02-13 · CVE-2014-0003

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.11.x through 2.11.3 Apache Camel versions 2.12.x through 2.12.2

Description The issue allows remote attackers to execute arbitrary Java methods via a crafted message, potentially leading to unauthorized access and control. This is related to the XSLT component in Apache Camel.

Recommendations For Apache Camel versions 2.11.x through 2.11.3, update to version 2.11.4 or later. For Apache Camel versions 2.12.x through 2.12.2, update to version 2.12.3 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-264

Related Identifiers

CVE-2014-0003

GHSA-H6RP-8V4J-HWPH

RHSA-2014:0245

RHSA-2014:0254

Affected Products

Apache Camel

References · 21

• 🔥 http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0003 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0371.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0372.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0254.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0245.html · Vendor Advisory
• http://secunia.com/advisories/57125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6rp-8v4j-hwph · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/e922f89290f236f3107039de61af0375826bd96d · Note
• https://github.com/apache/camel/commit/483b445dc77487e2d0f3d8c8bf1a7bbab04464c · Note
• https://github.com/apache/camel/commit/c6de749e9b3c7b61861c5480e91550290585224 · Note
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Note
• http://securityfocus.com/bid/65902 · Note