Description
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | activemq +1 | 5.9.0-4.redhat.610328.el6op | RHSA-2014:0245 |
| Red Hat OpenShift 1 | activemq +1 | 5.9.0-4.redhat.610328.el6op | RHSA-2014:0254 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.camel:camel-core | < 2.9.7 | 2.9.7 | GHSA-x9fv-c87w-55wc |
| Maven | org.apache.camel:camel-core | >= 2.10.0, < 2.10.7 | 2.10.7 | GHSA-x9fv-c87w-55wc |
| Maven | org.apache.camel:camel-core | >= 2.11.0, < 2.11.2 | 2.11.2 | GHSA-x9fv-c87w-55wc |
| Maven | org.apache.camel:camel-core | >= 2.12.0, < 2.12.1 | 2.12.1 | GHSA-x9fv-c87w-55wc |
Advisories 2
- RHSA-2014:0254 Red Hat Security Advisory: activemq security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0245 Red Hat Security Advisory: activemq security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 54888 third-party-advisory
- 20130930 CVE-2013-4330: Apache Camel critical disclosure vulnerability mailing-list
- RHSA-2013:1862 vendor-advisory
- apache-camel-cve20134330-code-exec(87542) vdb-entry
- RHSA-2014:0140 vendor-advisory
- RHSA-2014:0124 vendor-advisory
- RHSA-2014:0254 vendor-advisory
- 97941 vdb-entry
- RHSA-2014:0245 vendor-advisory
- http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1&modificationDate=1380535446943
- http://packetstormsecurity.com/files/123454/
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html mailing-list
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html mailing-list