Description
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.camel:camel-core | < 2.13.4 | 2.13.4 | GHSA-3hrc-f439-727g |
| Maven | org.apache.camel:camel-core | >= 2.14.0, < 2.14.2 | 2.14.2 | GHSA-3hrc-f439-727g |
References
- RHSA-2015:1539 vendor-advisory
- RHSA-2015:1041 vendor-advisory
- https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
- RHSA-2015:1538 vendor-advisory
- 1032442 vdb-entry
- https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html mailing-list
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html mailing-list