Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-0264 · ADVISORY
• apache/camel commit 7360aad · WEB
• apache/camel commit b47b51a · WEB
• camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc · WEB
• git-wip-us.apache.org/repos/asf · WEB
• GitHub Advisory GHSA-mhx2-r3jx-g94c · ADVISORY
• apache/camel · PACKAGE
• issues.apache.org/jira/browse/CAMEL-8312 · WEB
• lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · WEB
• lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E

Weitere Schwachstellen in org.apache.camel:camel-core

• CVE-2024-22371HOCH 7.5Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. …
• CVE-2020-11971HOCH 7.5Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should up…
• CVE-2019-0188HOCH 7.5Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSO…
• CVE-2019-0194HOCH 7.5Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.…
• CVE-2018-8027KRITISCH 9.8Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.