Lucene search

[email protected]CVE-2017-5643

HistoryMar 16, 2017 - 3:59 p.m.

CVE-2017-5643

2017-03-1615:59:00

CWE-918

[email protected]

web.nvd.nist.gov

cve

2017

5643

apache camel

validation component

ssrf

remote dtds

xxe

nvd

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

7.5 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.007 Low

EPSS

Percentile

79.8%

JSON

Apache Camel’s Validation Component is vulnerable against SSRF via remote DTDs and XXE.

CPENameOperatorVersion
apache:camelapache cameleq2.17.0
apache:camelapache cameleq2.17.2
apache:camelapache cameleq2.17.4
apache:camelapache cameleq2.17.3
apache:camelapache cameleq2.18.2
apache:camelapache cameleq2.17.5
apache:camelapache cameleq2.18.0
apache:camelapache camelle2.16.0
apache:camelapache cameleq2.17.1
apache:camelapache cameleq2.18.1

CPE	Name	Operator	Version
apache:camel	apache camel	eq	2.17.0
apache:camel	apache camel	eq	2.17.2
apache:camel	apache camel	eq	2.17.4
apache:camel	apache camel	eq	2.17.3
apache:camel	apache camel	eq	2.18.2
apache:camel	apache camel	eq	2.17.5
apache:camel	apache camel	eq	2.18.0
apache:camel	apache camel	le	2.16.0
apache:camel	apache camel	eq	2.17.1
apache:camel	apache camel	eq	2.18.1

References

camel.apache.org/security-advisories.data/CVE-2017-5643.txt.asc?version=1&modificationDate=1489652454000&api=v2

www.securityfocus.com/bid/97226

access.redhat.com/errata/RHSA-2017:1832

lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E

lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

7.5 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.007 Low

EPSS

Percentile

79.8%

JSON

Related for CVE-2017-5643

osv2 veracode1 prion1 redhatcve1 github1 redhat1