GHSA-vq9j-jh62-5hmp

Source

https://github.com/advisories/GHSA-vq9j-jh62-5hmp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-vq9j-jh62-5hmp/GHSA-vq9j-jh62-5hmp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vq9j-jh62-5hmp

Aliases

CVE-2017-5643

Published

2018-10-16T23:13:11Z

Modified

2024-02-20T05:51:54.850043Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Details

Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.

Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3.

The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:58:03Z"
}

References

Affected packages

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.17.6

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

2.*

2.0-M1

2.0-M2

2.0-M3

2.0.0

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.9.0-RC1

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.9.6

2.9.7

2.9.8

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.10.6

2.10.7

2.11.0

2.11.1

2.11.2

2.11.3

2.11.4

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

2.13.0

2.13.1

2.13.2

2.13.3

2.13.4

2.14.0

2.14.1

2.14.2

2.14.3

2.14.4

2.15.0

2.15.1

2.15.2

2.15.3

2.15.4

2.15.5

2.15.6

2.16.0

2.16.1

2.16.2

2.16.3

2.16.4

2.16.5

2.17.0

2.17.1

2.17.2

2.17.3

2.17.4

2.17.5

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.18.0

Fixed

2.18.2

Affected versions

2.*

2.18.0

2.18.1