Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Recommended action: Upgrade to 4.4.0, 4.0.4, 3.22.1 or 3.21.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
Recommended action: Upgrade to 2.12.1, 2.11.2, 2.10.7 or 2.9.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
Recommended action: Upgrade to 2.23.1, 2.22.3 or 2.21.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
Recommended action: Upgrade to 2.12.3 or 2.11.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Recommended action: Upgrade to 2.12.3 or 2.11.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources. Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3. The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.
Recommended action: Upgrade to 2.18.2 or 2.17.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Recommended action: Upgrade to 2.14.2 or 2.13.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Recommended action: Upgrade to 2.14.2 or 2.13.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Recommended action: Upgrade to 2.21.1 or 2.20.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.