Security Bulletin: Apache Camel Core vulnerability in IBM Tivoli Monitoring Data Provider (CVE-2020-11971)

Summary IBM Tivoli Monitoring Data provider is vulnerable to Apache Camel Core vulnerabilty CVE-2020-11971 Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel could allow a remote attacker to obtain sensitive information, caused by a rebind flaw in JMX. By sending a...

CVE-2022-45046

This flaw targets the camel-ldap package. According to the maintainers this CVE should be retracted soon. Mitigation Maintainers have added a documentation detail regarding LDAP Injection in Camel LDAP component. Please check the link for more information...

Moderate: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.18.3 release and security update

A minor version update from 3.14.5 to 3.18.3 is now available for Camel for Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

LDAP Injection

Camel LDAP is vulnerable to LDAP injection. The vulnerability is due to the process function in LdapProducer.java when using the filter options which allows an attacker to inject and execute LDAP queries into the system...

io.fabric8.funktion.connector:connector-ldap (>=1.1.9 <=1.1.55), org.apache.camel.kafkaconnector:camel-ldap-kafka-connector (>=0.10.1 <=0.11.5) +10 more potentially affected by CVE-2022-45046 via org.apache.camel:camel-ldap (>=2.13.4 <=3.14.5)

org.apache.camel:camel-ldap MAVEN version =2.13.4, =1.1.9, =0.10.1, =2.3.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =2.18.0, =4.4.354, =4.4.366 - org.wildfly.camel:wildfly-camel-itests-camel =11.0.0 - uk.nhs.ciao:ciao-spine-sds =0.1 - uk.nhs.ciao:ciao-transport-spine =0.1 Source cves: CVE-2022-45046 Sour...

org.apache.camel.quarkus:camel-quarkus-integration-test-ldap (>=2.8.0 <=2.13.2), org.apache.camel.quarkus:camel-quarkus-ldap (>=2.8.0 <=2.13.2) +2 more potentially affected by CVE-2022-45046 via org.apache.camel:camel-ldap (>=3.15.0 <=3.18.3)

org.apache.camel:camel-ldap MAVEN version =3.15.0, =2.8.0, =2.8.0, =2.8.0, =3.15.0, =3.18.3 Source cves: CVE-2022-45046 Source advisory: OSV:GHSA-W66J-XC7R-M2JV...

camel-ldap component allows LDAP Injection when using the filter option

The camel-ldap component allows LDAP Injection when using the filter option. Users are recommended to either move to the Camel-Spring-Ldap component which is not affected or upgrade to 3.14.6 or 3.18.4...

GHSA-W66J-XC7R-M2JV camel-ldap component allows LDAP Injection when using the filter option

The camel-ldap component allows LDAP Injection when using the filter option. Users are recommended to either move to the Camel-Spring-Ldap component which is not affected or upgrade to 3.14.6 or 3.18.4...

PT-2022-27391 · Apache · Camel-Ldap

Name of the Vulnerable Software and Affected Versions: camel-ldap versions prior to 3.14.6 camel-ldap versions prior to 3.18.4 Description: The camel-ldap component is affected by an LDAP Injection issue when using the filter option. This allows for potential security breaches. Users are advised ...

org.apache.camel.quarkus:camel-quarkus-coap (>=2.13.1 <=2.15.0), org.apache.camel.quarkus:camel-quarkus-coap-deployment (>=2.13.1 <=2.15.0) +16 more potentially affected by CVE-2022-39368 via org.eclipse.californium:scandium (>=2.7.0 <=2.7.3)

org.eclipse.californium:scandium MAVEN version =2.7.0, =2.13.1, =2.13.1, =2.13.1, =3.18.3, =3.18.3, =2.7.0, =2.7.0, =2.7.0, =1.10.1, =1.10.1, =1.10.1, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.1 and more Source cves: CVE-2022-39368 Source advisory: OSV:GHSA-P72G-CGH9-GHJG...

org.apache.camel.karaf:camel-coap (>=4.7.0 <=4.18.2), org.apache.camel.quarkus:camel-quarkus-coap (>=3.8.0 <=3.36.0) +32 more potentially affected by CVE-2022-39368 via org.eclipse.californium:scandium (>=3.0.0 <=3.6.0)

org.eclipse.californium:scandium MAVEN version =3.0.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.4.0, =4.4.0, =3.0.0, =3.0.0, =3.0.0, =3.12.0, =2.0.0, =2.0.0-M6, =2.0.0-M6, =2.0.0-M6, =2.0.0-M6, =2.0.0-M15 and more Source cves: CVE-2022-39368 Source advisory: OSV:GHSA-P72G-CGH9-GHJG...

Low: Red Hat Security Advisory: Red Hat Integration Camel-K 1.8.1 security update

A micro version update is now available for Red Hat Integration Camel K. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 release and security update

A minor version update from 3.14.2 to 3.14.5 is now available for Camel for Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

org.apache.camel:camel-shiro (=2.5.0), org.apache.shiro.samples:samples-aspectj (=1.0.0-incubating) +29 more potentially affected by CVE-2022-40664 via org.apache.shiro:shiro-core (=1.0.0-incubating)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - org.apache.camel:camel-shiro =2.5.0 - org.apache.shiro.samples:samples-aspectj...

Security Bulletin: A security vulnerability has been identified in Apache Camel shipped with IBM Tivoli Netcool Impact (CVE-2020-11971)

Summary Apache Camel is shipped with IBM Tivoli Netcool Impact as part of its backend infrastructure. Information about a security vulnerability affecting Apache Camel has been published in a security bulletin. Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel could allow a...

This Week in Spring - October 4th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its October 4th, 2022, and Im in Austin, TX, for the new version of show formerly known as the Kafka Summit, here to talk to folks about the amazing opportunities for Spring Boot and Apache Kafka. On the 12th, Ill be in...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel-K 1.8 security update

A minor version update is now available for Red Hat Integration Camel K. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

io.github.xiaomisum:ryze-coap (=6.1.0), org.apache.camel.karaf:camel-coap (>=4.7.0 <=4.18.2) +34 more potentially affected by CVE-2022-2576 via org.eclipse.californium:californium-core (>=3.0.0 <=3.5.0)

org.eclipse.californium:californium-core MAVEN version =3.0.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.4.0, =4.4.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.12.0, =2.0.0, =2.0.0-M6, =2.0.0-M15 and more Source cves: CVE-2022-2576 Source advisory: OSV:GHSA-QQ3J-44GW-CF6R...

com.github.xitren.fx:signal-ui-fx (>=1.5.2 <=1.7.10), nl.stijngroenen.tradfri:ikea-tradfri-api (>=1.0.0 <=1.2.0) +26 more potentially affected by CVE-2022-2576 via org.eclipse.californium:californium-core (>=2.0.0 <=2.7.2)

org.eclipse.californium:californium-core MAVEN version =2.0.0, =1.5.2, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.1.0, =3.1.0, =2.0.0, =2.0.0, =2.3.0, =2.7.2 and more Source cves: CVE-2022-2576 Source advisory:...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.7 security update

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...