REDHAT-BUG-1049675
First published: Wed Jan 08 2014(Updated: )
It was found that the Apache Camel XSLT component would resolve entities in XML messages when transforming them using an xslt: route. A remote attacker able to submit messages to an xslt: Camel route could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Apache Camel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://issues.apache.org/jira/browse/CAMEL-7130
- https://fisheye6.atlassian.com/changelog/camel-git?cs=7c9326f4962cdad97d5de89cfb4483e04cab1d35
- https://fisheye6.atlassian.com/changelog/camel-git?cs=cc192f87b7c4a43c6cff0646486384c9946e2ac9
- http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc
- https://rhn.redhat.com/errata/RHSA-2014-0323.html
- https://rhn.redhat.com/errata/RHSA-2014-0371.html
- https://rhn.redhat.com/errata/RHSA-2014-0372.html
- https://rhn.redhat.com/errata/RHSA-2014-0452.html
- https://rhn.redhat.com/errata/RHSA-2014-0459.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1049675
Frequently Asked Questions
What is the severity of REDHAT-BUG-1049675?
The severity of REDHAT-BUG-1049675 is high due to potential information disclosure risks.
How do I fix REDHAT-BUG-1049675?
To fix REDHAT-BUG-1049675, update to the latest version of the Apache Camel that addresses this vulnerability.
What does REDHAT-BUG-1049675 affect?
REDHAT-BUG-1049675 affects the Apache Camel XSLT component used in XML message processing.
Can REDHAT-BUG-1049675 lead to a remote code execution?
REDHAT-BUG-1049675 does not directly lead to remote code execution but allows unauthorized file access.
Who is affected by REDHAT-BUG-1049675?
Any users running the Red Hat Build of Apache Camel with the XSLT component enabled are affected by REDHAT-BUG-1049675.
- collector/redhat-bugzilla
- alias/CVE-2014-0002
- agent/type
- agent/references
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/red hat build of apache camel