| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.camel:camel-core | ≥ 2.18.0, < 2.18.2< 2.17.6 | 2.18.22.17.6 |
| camel | = 2.17.0= 2.17.1= 2.17.2= 2.17.3= 2.17.4= 2.17.5= 2.18.0= 2.18.1= 2.18.2≤ 2.16.0 |
Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.
Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3.
The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free