what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 34 RSS Feed

Files

Apache Camel 2.x Critical Disclosure
Posted Sep 30, 2013
Authored by Gregory Draperi

Apache Camel versions 2.9.0 to 2.9.7, 2.10.0 to 2.10.6, 2.11.0 to 2.11.1, and 2.12.0 suffers from a remote command execution vulnerability based on how message headers are interpreted.

tags | advisory, remote, info disclosure
advisories | CVE-2013-4330
SHA-256 | 1f20fed4bf0aae4159245be3336a4b327d8066c6bab740968ed8bf4deb7260c6

Related Files

Red Hat Security Advisory 2022-1333-01
Posted Apr 13, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-1333-01 - A micro version update is now available for Red Hat Camel K that includes CVE fixes in the base images, which are documented in the Release Notes document linked in the References section.

tags | advisory
systems | linux, redhat
advisories | CVE-2022-22965
SHA-256 | 84e3b3e03146ec3ba0a8f461d400dfce1432660b1bb8dd1e467123d498398499
Red Hat Security Advisory 2022-1306-01
Posted Apr 11, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-1306-01 - A security update to Red Hat Integration Camel Extensions for Quarkus 2.2.1 is now available. Issues addressed include a remote code execution vulnerability.

tags | advisory, remote, code execution
systems | linux, redhat
advisories | CVE-2022-22965
SHA-256 | c3c5d0930ccc1fe38ee5366563b5d922321b3645300f06dfcd16a55e0f841566
Red Hat Security Advisory 2022-1029-01
Posted Mar 23, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-1029-01 - A micro version update is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include cross site scripting, denial of service, information leakage, and server-side request forgery vulnerabilities.

tags | advisory, denial of service, vulnerability, xss
systems | linux, redhat
advisories | CVE-2020-15522, CVE-2020-27218, CVE-2020-8908, CVE-2021-20293, CVE-2021-21349, CVE-2021-26291, CVE-2021-28168, CVE-2021-28170, CVE-2021-33813, CVE-2021-3690, CVE-2022-24407
SHA-256 | e1a2e4b551ccd5d032fc05c0712cca1e96b04eea7c46e8e7109f20f450bbd890
Red Hat Security Advisory 2022-1013-01
Posted Mar 23, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-1013-01 - Red Hat Integration - Camel Extensions for Quarkus 2.2.1 serves as a replacement for 2.2 and includes security fixes. Issues addressed include code execution, denial of service, deserialization, information leakage, and memory leak vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution, memory leak
systems | linux, redhat
advisories | CVE-2020-15522, CVE-2020-8908, CVE-2021-22569, CVE-2021-2471, CVE-2021-26291, CVE-2021-28168, CVE-2021-28170, CVE-2021-30129, CVE-2021-37136, CVE-2021-37137, CVE-2021-40690, CVE-2021-41269, CVE-2021-4178, CVE-2021-42392
SHA-256 | d5cfb7d93bd17d4a300c3574ceea4314e4c04e0e4b82484593f5c02a870e2682
Red Hat Security Advisory 2022-0223-02
Posted Jan 21, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0223-02 - A minor version update is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and denial of service vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2021-44832, CVE-2021-45046, CVE-2021-45105
SHA-256 | af1dffa6e0ac34a66deb47e28f78f747246b426fc1a6679d8adeeaeca095b063
Red Hat Security Advisory 2022-0222-02
Posted Jan 21, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0222-02 - This update of Red Hat Integration - Camel Extensions for Quarkus serves as a replacement for 2.2 GA. Issues addressed include code execution and denial of service vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2021-44832, CVE-2021-45046, CVE-2021-45105
SHA-256 | 68d13130bc2f69e24bed215494e5bc7bc7e78f76f91132c976acd5299a52c762
Red Hat Security Advisory 2021-5126-01
Posted Dec 15, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-5126-01 - This update of Red Hat Integration - Camel Extensions for Quarkus serves as a replacement for 2.2 GA and includes the following security Fix: log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value. Issues addressed include a code execution vulnerability.

tags | advisory, remote, code execution
systems | linux, redhat
advisories | CVE-2021-44228
SHA-256 | 3626a09f3926f74d21efaa69d5715e3a64a7c3076d2073a42f8c39d4bf510155
Red Hat Security Advisory 2021-5130-02
Posted Dec 15, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-5130-02 - A minor version update is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a code execution vulnerability.

tags | advisory, code execution
systems | linux, redhat
advisories | CVE-2021-44228
SHA-256 | 68c8a64ff7bad5739dc048138d6f18fe663311a5a857e025bb4533995862f1a7
Red Hat Security Advisory 2021-4918-03
Posted Dec 3, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-4918-03 - A minor version update is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, denial of service, deserialization, information leakage, privilege escalation, and server-side request forgery vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2020-13936, CVE-2020-14326, CVE-2020-28491, CVE-2021-20328, CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21350, CVE-2021-21351, CVE-2021-22118, CVE-2021-27568, CVE-2021-29505, CVE-2021-31812, CVE-2021-39139, CVE-2021-39140, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148
SHA-256 | d5c90a3e7232924ae6e8b38f5e9ef8c694af77ff921bcdb7b07c49f3c69e7068
Red Hat Security Advisory 2021-4767-01
Posted Nov 23, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-4767-01 - This release of Red Hat Integration - Camel Extensions for Quarkus - 2.2 GA serves as a replacement for tech-preview 2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass, code execution, denial of service, deserialization, information leakage, resource exhaustion, and server-side request forgery vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2020-13936, CVE-2020-14326, CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2020-27218, CVE-2020-27223, CVE-2020-28052, CVE-2020-28491, CVE-2021-20289, CVE-2021-20328, CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351, CVE-2021-27568, CVE-2021-28163, CVE-2021-28164, CVE-2021-28165
SHA-256 | 9dff15e298c722ad84d5f39cb4d850c04124d91986161bb1afd605f4e69d1c9d
Red Hat Security Advisory 2021-3207-01
Posted Aug 18, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-3207-01 - This release of Red Hat Integration - Camel Quarkus - 1.8.1 tech-preview 2 serves as a replacement for tech-preview 1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, denial of service, information leakage, man-in-the-middle, and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2020-13920, CVE-2020-17518, CVE-2020-17521, CVE-2020-26238, CVE-2020-27222, CVE-2020-27782, CVE-2020-29582, CVE-2021-20218
SHA-256 | 45c967c8a201b1f39d4acd990e209ab0096988439ff4cec5216e3227f4f3dc4b
Red Hat Security Advisory 2021-3205-01
Posted Aug 18, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-3205-01 - A minor version update is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass, code execution, denial of service, information leakage, man-in-the-middle, and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2020-13920, CVE-2020-17518, CVE-2020-17521, CVE-2020-26238, CVE-2020-27222, CVE-2020-27782, CVE-2020-28052, CVE-2020-29582, CVE-2021-20218, CVE-2021-27807, CVE-2021-27906, CVE-2021-30468, CVE-2021-31811
SHA-256 | 2c0be2bf30994c0e78e9f0282ebe4ea1c42cf7bd92b633df388b40a2dc8c649c
Red Hat Security Advisory 2021-0811-01
Posted Mar 12, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0811-01 - This release of Red Hat Integration - Camel K - Tech-Preview 3 serves as a replacement for tech-preview 2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include XML injection and man-in-the-middle vulnerabilities.

tags | advisory, vulnerability
systems | linux, redhat
advisories | CVE-2020-13946, CVE-2020-13956, CVE-2020-25649
SHA-256 | c28667fc0da99f8d9f7d95ddffa82106e756d05bf694491cc1ef1780fba154b5
Red Hat Security Advisory 2021-0110-01
Posted Jan 13, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0110-01 - This release of Red Hat Integration - Camel K - Tech-Preview 2 serves as a replacement for tech-preview 1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include an XML injection vulnerability.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-13692
SHA-256 | 0072214b8752c91826227c41bc21cb074fffe02b75be65b68b6fa1f4c88b26dc
Apache Camel Exploitation
Posted Jul 4, 2019
Authored by Nick Aliferopoulos

Whitepaper called Apache Camel Exploitation. It discusses how unvalidated input in Apache Camel endpoints can result in information exposure.

tags | paper
SHA-256 | 7ed20d8d1893d6d7876e248a8838efd2c8bd000ecac1c0bbcd721d515d9128bd
Apache Camel XStream Remote Code Execution
Posted Feb 1, 2016
Authored by Claus Ibsen

Apache Camel's XStream usage is vulnerable to remote code execution attacks.

tags | advisory, remote, code execution
advisories | CVE-2015-5344
SHA-256 | 6bf8487864efa20e694932faf47109da3b14f7c1f8583c00bae99071c0141ec0
Apache Camel Java Object Deserialization
Posted Dec 17, 2015
Authored by Claus Ibsen

Apache Camel's Jetty/Servlet usage is vulnerable to a Java object de-serialization vulnerability.

tags | advisory, java
advisories | CVE-2015-5348
SHA-256 | 2dc9dd223b8636940a69a92a2c8ec700896baacff115824e13e45e41f355a595
Red Hat Security Advisory 2015-1539-01
Posted Aug 4, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1539-01 - Red Hat JBoss BPM Suite is a business rules and processes management system for the management, storage, creation, modification, and deployment of JBoss rules and BPMN2-compliant business processes. This release of Red Hat JBoss BPM Suite 6.1.2 serves as a replacement for Red Hat JBoss BPM Suite 6.1.0, and includes bug fixes and enhancements, which are documented in the README.txt file included with the patch files. The following security issues are also fixed with this release: It was found that Apache Camel's XML converter performed XML External Entity expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.

tags | advisory, remote, xxe
systems | linux, redhat
advisories | CVE-2015-0263, CVE-2015-0264, CVE-2015-1818
SHA-256 | 56627352a7df2d86dd0a52f57fc03ccdd0383b7f81d892b51ba9198d83ea8692
Red Hat Security Advisory 2015-1538-01
Posted Aug 4, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1538-01 - Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This release of Red Hat JBoss BRMS 6.1.2 serves as a replacement for Red Hat JBoss BRMS 6.1.0, and includes bug fixes and enhancements, which are documented in the README.txt file included with the patch files. The following security issues are also fixed with this release: It was found that Apache Camel's XML converter performed XML External Entity expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.

tags | advisory, remote, xxe
systems | linux, redhat
advisories | CVE-2015-0263, CVE-2015-0264
SHA-256 | cd8d3c1f817b1c9faba0d4e0599cebb2aa48f6de86fd4533c50a3f58ab9d4d37
Red Hat Security Advisory 2015-1041-01
Posted Jun 1, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1041-01 - Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0. It includes several bug fixes, which are documented in the readme.txt file included with the patch files. The following security issues are addressed in this release: It was found that Apache Camel's XML converter performed XML External Entity expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.

tags | advisory, remote, xxe
systems | linux, redhat
advisories | CVE-2015-0263, CVE-2015-0264
SHA-256 | ca80b7b5b399e7d7f9d4b52fc1738483535cd392df8030a2096d79d0ce76f1a9
Red Hat Security Advisory 2014-0254-01
Posted Mar 6, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0254-01 - Apache ActiveMQ provides a SOA infrastructure to connect processes across heterogeneous systems. A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. It was found that the Apache Camel XSLT component allowed XSL stylesheets to call external Java methods. A remote attacker able to submit messages to a Camel route could use this flaw to perform arbitrary remote code execution in the context of the Camel server process.

tags | advisory, java, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-2035, CVE-2013-4152, CVE-2013-4330, CVE-2014-0003
SHA-256 | 582404ee5321477d2cb59fc61c8baa71cc260fc0e66a6ea75d31f89c594e8b4a
Red Hat Security Advisory 2014-0245-01
Posted Mar 3, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0245-01 - Apache ActiveMQ provides a SOA infrastructure to connect processes across heterogeneous systems. A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. It was found that the Apache Camel XSLT component allowed XSL stylesheets to call external Java methods. A remote attacker able to submit messages to a Camel route could use this flaw to perform arbitrary remote code execution in the context of the Camel server process.

tags | advisory, java, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-2035, CVE-2013-4152, CVE-2013-4330, CVE-2014-0003
SHA-256 | 2e94e8a1c355505c1954424496b8001a3e24d262909aa6bd71a8c6f8c99b3696
Apache Camel Critical Disclosure
Posted Mar 2, 2014
Authored by David Jorm | Site camel.apache.org

The Apache Camel XSLT component allows XSL stylesheets to perform calls to external Java methods. A remote attacker able to submit messages to an xslt Camel route could use this flaw to perform arbitrary remote code execution in the context of the Camel server process.

tags | advisory, java, remote, arbitrary, code execution
advisories | CVE-2014-0003
SHA-256 | 16d61125bccfc6affa82e15c5c566204232ffce7c6669084cb73248d471b2e3e
Apache Camel Resolve Entities Information Disclosure
Posted Mar 2, 2014
Authored by David Jorm | Site camel.apache.org

The Apache Camel XSLT component will resolve entities in XML messages when transforming them using an xslt route. A remote attacker able to submit messages to an xslt route could use this flaw to read files accessible to the running application server and potentially perform other more advanced XXE attacks. Versions affected include Camel 2.11.0 to 2.11.3 and Camel 2.12.0 to 2.12.2.

tags | advisory, remote, xxe
advisories | CVE-2014-0002
SHA-256 | fdf7091172d1b40b3ec4395b99eb19719f939f7a365eba05f6877cc447aea1a5
Red Hat Security Advisory 2014-0140-01
Posted Feb 5, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0140-01 - Apache Camel is a versatile open-source integration framework based on known Enterprise Integration Patterns. A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language expressions in the FILE_NAME header that would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. All users of the affected products as provided from the Red Hat Customer Portal are advised to apply this update.

tags | advisory, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-4330
SHA-256 | bc81dc060c390772a5b1a581a7e8a45b6cf676ad3b0ee4a9c285540cd86c822d
Page 1 of 2
Back12Next

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close