GitHub Advisoryadvisory · Maven

GHSA-vq9j-jh62-5hmp Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

HIGH Published 2018-10-16 Modified 2023-12-19 Official page ↗
Aliases
CVE-2017-5643
Ecosystem
Maven
Packages
org.apache.camel:camel-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weaknesses
CWE-918
Reviewed
2020-06-16

Affected packages

• Maven org.apache.camel:camel-core: < 2.17.6 → fixed in 2.17.6 • Maven org.apache.camel:camel-core: >= 2.18.0, < 2.18.2 → fixed in 2.18.2

Description

Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources. Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3. The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.

Related

Alias · CVE (1)

  • CVE-2017-5643 Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References