PT-2022-27391 · Apache · Camel-Ldap

Published 2022-12-05 · Updated 2022-12-19 · CVE-2022-45046

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions camel-ldap versions prior to 3.14.6 camel-ldap versions prior to 3.18.4

Description The camel-ldap component is affected by an LDAP Injection issue when using the filter option. This allows for potential security breaches. Users are advised to either switch to the Camel-Spring-Ldap component, which is not affected, or upgrade to a secure version.

Recommendations For camel-ldap versions prior to 3.14.6, upgrade to version 3.14.6 or later. For camel-ldap versions prior to 3.18.4, upgrade to version 3.18.4 or later. As a temporary workaround, consider restricting the use of the filter option in the camel-ldap component until a patch is applied.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2022-45046

GHSA-W66J-XC7R-M2JV

Affected Products

Camel-Ldap

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-45046 · Security Note
• https://osv.dev/vulnerability/GHSA-w66j-xc7r-m2jv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45046 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://t.me/cvenotify/39120 · Telegram Post
• http://openwall.com/lists/oss-security/2022/12/05/2 · Note
• https://camel.apache.org/security/CVE-2022-45046.html · Note
• https://t.me/cibsecurity/53970 · Telegram Post