PT-2015-4552 · Apache · Apache Camel

Stephan Siano · Published 2015-06-03 · Updated 2019-05-24 · CVE-2015-0264

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.13.4 Apache Camel versions 2.14.x prior to 2.14.2

Description The issue allows remote attackers to read arbitrary files via an external entity in an invalid XML String or GenericFile object in an XPath query. This is due to multiple XML external entity (XXE) vulnerabilities in the builder/xml/XPathBuilder.java file.

Recommendations For Apache Camel versions prior to 2.13.4, update to version 2.13.4 or later. For Apache Camel versions 2.14.x prior to 2.14.2, update to version 2.14.2 or later. As a temporary workaround, consider restricting the use of external entities in XPath queries until a patch is available.

Fix

Related Identifiers

CVE-2015-0264

GHSA-MHX2-R3JX-G94C

Affected Products

Apache Camel

References · 18

• http://rhn.redhat.com/errata/RHSA-2015-1539.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1041.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhx2-r3jx-g94c · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1538.html · Vendor Advisory
• https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0264 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/7360aada5154434c68774aa30e0f21ddc5f27b9f · Note
• https://github.com/apache/camel/commit/b47b51a195b38e7ab7c099d19910af70a16638f6 · Note
• https://github.com/advisories/GHSA-mhx2-r3jx-g94c · Note
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Note
• https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=1df559649a96a1ca0368373387e542f46e4820da · Note
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E · Note
• https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da · Note