PT-2019-3933 · None+1 · Json-Lib+1

Published 2019-05-28 · Updated 2021-03-15 · CVE-2019-0188

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.24.0

Description The issue is related to an XML external entity injection (XXE) vulnerability due to the use of an outdated vulnerable JSON-lib library. This affects the camel-xmljson component. The vulnerability can be exploited by a remote attacker to perform an XXE attack.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue. As a temporary workaround, consider disabling the camel-xmljson component until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2019-04411

CVE-2019-0188

GHSA-H896-MX9X-G32G

Affected Products

Apache Camel

Json-Lib

References · 32

• 🔥 https://github.com/apache/camel/blob/master/docs/user-manual/en/security-advisories/CVE-2019-0188.txt.asc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-0188 · Security Note
• https://osv.dev/vulnerability/GHSA-h896-mx9x-g32g · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04411 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0188 · Vendor Advisory
• https://lists.apache.org/thread.html/6fefbd90f7fb4c8412d85ea3e9e97a4b76b47e206f502c73c29dc0b7%40%3Ccommits.tamaya.apache.org%3E · Note
• https://lists.apache.org/thread.html/45349f8bd98c1c13a84beddede18fe79b8619ebab99d90f1fb43d7ab@%3Cdev.tamaya.apache.org%3E · Note
• https://lists.apache.org/thread.html/00118387610522b107cbdcec5369ddd512b576ff0236a02bfca12f44%40%3Cusers.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/eed73fc18d4fa3e2341cd0ab101b47f06b16c7efc1cb73791c524c9d@%3Cdev.tamaya.apache.org%3E · Note
• https://lists.apache.org/thread.html/fe74d173689600d9a395d026f0bf5d154c0bf7bd195ecfbc2c987036@%3Cdev.tamaya.apache.org%3E · Note
• https://lists.apache.org/thread.html/61601cda2c5f9832184ea14647b0c0589c94126a460c8eb196be1313%40%3Ccommits.tamaya.apache.org%3E · Note
• http://securityfocus.com/bid/108422 · Note
• https://oracle.com/security-alerts/cpujan2021.html · Note
• https://oracle.com/security-alerts/cpujul2020.html · Note
• https://lists.apache.org/thread.html/84ba9b79e801a4148dde73d1969cdae0247d11ff63de7ce11b394dc5%40%3Ccommits.tamaya.apache.org%3E · Note