Most recent entries from all

cnvd-2017-03795

EUVD-2026-73474

fkie_cve-2017-5643

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

GHSA-vq9j-jh62-5hmp — Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Affected: Maven: org.apache.camel:camel-core

Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.

Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3.

The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.

gsd-2017-5643

RHSA-2017:1832 — Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

bouncycastle: Information disclosure in GCMBlockCipher camel-jacksonxml: Unmarshalling operation are vulnerable to RCE Security: Improper handling of path parameters allows bypassing the security constraint hawtio: Proxy is sharing cookies among all the clients hawtio: information Disclosure flaws due to unsafe path traversal cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens logback: Serialization vulnerability in SocketServer and ServerSocketReceiver XStream: DoS when unmarshalling void type