PT-2019-11184 · Apache · Apache Camel

Published 2019-04-30 · Updated 2019-05-24 · CVE-2019-0194

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Camel versions 2.19 and earlier Apache Camel versions 2.21.0 through 2.21.3 Apache Camel versions 2.22.0 through 2.22.2 Apache Camel version 2.23.0

Description: The issue concerns directory traversal in Apache Camel's File component.

Recommendations: For versions 2.19 and earlier, consider upgrading to a supported version to mitigate the risk. For versions 2.21.0 through 2.21.3, update to a version outside of this range. For versions 2.22.0 through 2.22.2, update to a version outside of this range. For version 2.23.0, update to a version outside of this range.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-0194

GHSA-4WJQ-69RC-8WCP

Affected Products

Apache Camel

References · 19

• 🔥 https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76@%3Cdev.camel.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/45e23ade8d3cb754615f95975e89e8dc73c59eeac914f07d53acbac6@%3Ccommits.camel.apache.org%3E · Exploit
• 🔥 http://openwall.com/lists/oss-security/2019/04/30/2 · Exploit
• 🔥 https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/0a163d02169d3d361150e8183df4af33f1a3d8a419b2937ac8e6c66f@%3Cusers.camel.apache.org%3E · Exploit
• https://osv.dev/vulnerability/GHSA-4wjq-69rc-8wcp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0194 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/2700 · Note
• https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76%40%3Cdev.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/45e23ade8d3cb754615f95975e89e8dc73c59eeac914f07d53acbac6%40%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/9a6bc022f7ab28e4894b1831ce336eb41ae6d5c24d86646fe16e956f%40%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E · Note