CVE-2020-11971: Input Validation
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/camelto a version that resolves this vulnerability.Fixed in 3.2.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 3.2.0 - Configuration
Disable Apache Camel JMX by setting the Java system property -Dorg.apache.camel.jmx.disabled=true.
Apache Camel JMX -Dorg.apache.camel.jmx.disabled = true - Configuration
Disable the vulnerable JMX agent by calling camel.disableJMX() on the CamelContext (if using the CamelContext method).
Apache Camel CamelContext disableJMX() = called - Configuration
If using Spring, disable the vulnerable JMX instrumentation agent in the Camel configuration by setting <jmxAgent id="agent" disabled="true"/> inside the <camelContext>.
Apache Camel Spring configuration (camelContext) <jmxAgent disabled> = true
Event History
Frequently Asked Questions
What is CVE-2020-11971?
CVE-2020-11971 is a vulnerability in Apache Camel's JMX that allows for a rebind flaw.
What versions of Apache Camel are affected by CVE-2020-11971?
Apache Camel versions 2.22.x, 2.23.x, 2.24.x, 2.25.x, and 3.0.0 up to 3.1.0 are affected by CVE-2020-11971.
How severe is CVE-2020-11971?
CVE-2020-11971 has a severity rating of 7.5 (high).
How can I fix CVE-2020-11971?
To fix CVE-2020-11971, users should upgrade to Apache Camel version 3.2.0.
Where can I find more information about CVE-2020-11971?
You can find more information about CVE-2020-11971 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2020-11971) and the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2020-11971).