Description
The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | activemq +1 | 5.9.0-4.redhat.610328.el6op | RHSA-2014:0245 |
| Red Hat OpenShift 1 | activemq +1 | 5.9.0-4.redhat.610328.el6op | RHSA-2014:0254 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.camel:camel-core | >= 2.11.0, < 2.11.4 | 2.11.4 | GHSA-h6rp-8v4j-hwph |
| Maven | org.apache.camel:camel-core | >= 2.12.0, < 2.12.3 | 2.12.3 | GHSA-h6rp-8v4j-hwph |
Advisories 2
- RHSA-2014:0254 Red Hat Security Advisory: activemq security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0245 Red Hat Security Advisory: activemq security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 57125 third-party-advisory
- RHSA-2014:0254 vendor-advisory
- RHSA-2014:0371 vendor-advisory
- 65902 vdb-entry
- 57719 third-party-advisory
- RHSA-2014:0245 vendor-advisory
- 57716 third-party-advisory
- http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc
- RHSA-2014:0372 vendor-advisory
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html mailing-list
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html mailing-list