Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-12634 (GCVE-0-2017-12634)
Vulnerability from cvelistv5
Published
2017-11-15 15:00
Modified
2024-09-16 18:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks
Summary
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel |
Version: 2.19.0 to 2.19.3 Version: 2.20.0 Version: The unsupported Camel 2.x (2.18 and earlier) versions may be also affected. |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:43:56.451Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2018:0319",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"name": "101876",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101876"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Camel",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "2.19.0 to 2.19.3"
},
{
"status": "affected",
"version": "2.20.0"
},
{
"status": "affected",
"version": "The unsupported Camel 2.x (2.18 and earlier) versions may be also affected."
}
]
}
],
"datePublic": "2017-11-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-24T10:06:03",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"name": "RHSA-2018:0319",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"name": "101876",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101876"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2017-11-15T00:00:00",
"ID": "CVE-2017-12634",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Camel",
"version": {
"version_data": [
{
"version_value": "2.19.0 to 2.19.3"
},
{
"version_value": "2.20.0"
},
{
"version_value": "The unsupported Camel 2.x (2.18 and earlier) versions may be also affected."
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2018:0319",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"name": "101876",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101876"
},
{
"name": "https://issues.apache.org/jira/browse/CAMEL-11929",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"name": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc",
"refsource": "CONFIRM",
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2017-12634",
"datePublished": "2017-11-15T15:00:00Z",
"dateReserved": "2017-08-07T00:00:00",
"dateUpdated": "2024-09-16T18:43:28.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-12634\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2017-11-15T15:29:00.257\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.\"},{\"lang\":\"es\",\"value\":\"El componente camel-castor en Apache Camel en versiones 2.x anteriores a la 2.19.4 y las versiones 2.20.x anteriores a la 2.20.1 es vulnerable a una deserializaci\u00f3n de objetos Java. La deserializaci\u00f3n de datos no fiables puede conducir a fallos de seguridad.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.19.4\",\"matchCriteriaId\":\"54ED7637-2D7F-44DB-A113-DB40AC77DBF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.20.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D605B884-CC2D-413B-8602-443A35517B00\"}]}]}],\"references\":[{\"url\":\"http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/101876\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0319\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/CAMEL-11929\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/101876\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0319\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/CAMEL-11929\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
fkie_cve-2017-12634
Vulnerability from fkie_nvd
Published
2017-11-15 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54ED7637-2D7F-44DB-A113-DB40AC77DBF3",
"versionEndExcluding": "2.19.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.20.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D605B884-CC2D-413B-8602-443A35517B00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws."
},
{
"lang": "es",
"value": "El componente camel-castor en Apache Camel en versiones 2.x anteriores a la 2.19.4 y las versiones 2.20.x anteriores a la 2.20.1 es vulnerable a una deserializaci\u00f3n de objetos Java. La deserializaci\u00f3n de datos no fiables puede conducir a fallos de seguridad."
}
],
"id": "CVE-2017-12634",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-15T15:29:00.257",
"references": [
{
"source": "security@apache.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"source": "security@apache.org",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101876"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"source": "security@apache.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101876"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
}
],
"sourceIdentifier": "security@apache.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
rhsa-2018_0319
Vulnerability from csaf_redhat
Published
2018-02-14 19:29
Modified
2024-11-22 11:40
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
Notes
Topic
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.
This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.
Security Fix(es):
* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)
* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)
* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)
* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)
* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)
The CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. \n\nRed Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)\n\n* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)\n\n* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)\n\n* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)\n\n* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)\n\nThe CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2018:0319",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/",
"url": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/"
},
{
"category": "external",
"summary": "1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "ENTESB-7397",
"url": "https://issues.redhat.com/browse/ENTESB-7397"
},
{
"category": "external",
"summary": "ENTESB-7398",
"url": "https://issues.redhat.com/browse/ENTESB-7398"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0319.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T11:40:17+00:00",
"generator": {
"date": "2024-11-22T11:40:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2018:0319",
"initial_release_date": "2018-02-14T19:29:46+00:00",
"revision_history": [
{
"date": "2018-02-14T19:29:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2018-02-14T19:29:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T11:40:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss A-MQ 6.3",
"product": {
"name": "Red Hat JBoss A-MQ 6.3",
"product_id": "Red Hat JBoss A-MQ 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_amq:6.3"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.3",
"product": {
"name": "Red Hat JBoss Fuse 6.3",
"product_id": "Red Hat JBoss Fuse 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Hooman Broujerdi"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2017-2617",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2017-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1419363"
}
],
"notes": [
{
"category": "description",
"text": "It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on a target machine where hawtio is deployed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Hawtio: Unrestricted file upload leads to RCE",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2617"
},
{
"category": "external",
"summary": "RHBZ#1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2617",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2617"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617"
}
],
"release_date": "2017-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Hawtio: Unrestricted file upload leads to RCE"
},
{
"cve": "CVE-2017-5662",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2017-04-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443592"
}
],
"notes": [
{
"category": "description",
"text": "An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server\u0027s filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "batik: XML external entity processing vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The batik package is no longer used or required by the Red Hat Virtualization Manager. Red Hat recommends removing it after updating to Red Hat Virtualization 4.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5662"
},
{
"category": "external",
"summary": "RHBZ#1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5662",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5662"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "batik: XML external entity processing vulnerability"
},
{
"cve": "CVE-2017-8028",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2017-10-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1510968"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and when setting userSearch, authentication is allowed with an arbitrary password when the username is correct.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-8028"
},
{
"category": "external",
"summary": "RHBZ#1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-8028",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-8028"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028"
}
],
"release_date": "2017-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password"
},
{
"cve": "CVE-2017-12633",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513382"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12633"
},
{
"category": "external",
"summary": "RHBZ#1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks"
},
{
"cve": "CVE-2017-12634",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513376"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12634"
},
{
"category": "external",
"summary": "RHBZ#1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12634",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12634"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks"
}
]
}
rhsa-2018:0319
Vulnerability from csaf_redhat
Published
2018-02-14 19:29
Modified
2025-09-10 14:21
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
Notes
Topic
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.
This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.
Security Fix(es):
* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)
* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)
* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)
* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)
* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)
The CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. \n\nRed Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)\n\n* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)\n\n* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)\n\n* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)\n\n* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)\n\nThe CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2018:0319",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/",
"url": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/"
},
{
"category": "external",
"summary": "1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "ENTESB-7397",
"url": "https://issues.redhat.com/browse/ENTESB-7397"
},
{
"category": "external",
"summary": "ENTESB-7398",
"url": "https://issues.redhat.com/browse/ENTESB-7398"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0319.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update",
"tracking": {
"current_release_date": "2025-09-10T14:21:48+00:00",
"generator": {
"date": "2025-09-10T14:21:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2018:0319",
"initial_release_date": "2018-02-14T19:29:46+00:00",
"revision_history": [
{
"date": "2018-02-14T19:29:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2018-02-14T19:29:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:21:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss A-MQ 6.3",
"product": {
"name": "Red Hat JBoss A-MQ 6.3",
"product_id": "Red Hat JBoss A-MQ 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_amq:6.3"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.3",
"product": {
"name": "Red Hat JBoss Fuse 6.3",
"product_id": "Red Hat JBoss Fuse 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Hooman Broujerdi"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2017-2617",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2017-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1419363"
}
],
"notes": [
{
"category": "description",
"text": "It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on a target machine where hawtio is deployed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Hawtio: Unrestricted file upload leads to RCE",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2617"
},
{
"category": "external",
"summary": "RHBZ#1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2617",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2617"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617"
}
],
"release_date": "2017-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Hawtio: Unrestricted file upload leads to RCE"
},
{
"cve": "CVE-2017-5662",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2017-04-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443592"
}
],
"notes": [
{
"category": "description",
"text": "An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server\u0027s filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "batik: XML external entity processing vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The batik package is no longer used or required by the Red Hat Virtualization Manager. Red Hat recommends removing it after updating to Red Hat Virtualization 4.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5662"
},
{
"category": "external",
"summary": "RHBZ#1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5662",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5662"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "batik: XML external entity processing vulnerability"
},
{
"cve": "CVE-2017-8028",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2017-10-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1510968"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and when setting userSearch, authentication is allowed with an arbitrary password when the username is correct.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-8028"
},
{
"category": "external",
"summary": "RHBZ#1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-8028",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-8028"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028"
}
],
"release_date": "2017-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password"
},
{
"cve": "CVE-2017-12633",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513382"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12633"
},
{
"category": "external",
"summary": "RHBZ#1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks"
},
{
"cve": "CVE-2017-12634",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513376"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12634"
},
{
"category": "external",
"summary": "RHBZ#1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12634",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12634"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks"
}
]
}
RHSA-2018:0319
Vulnerability from csaf_redhat
Published
2018-02-14 19:29
Modified
2025-09-10 14:21
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update
Notes
Topic
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.
This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.
Security Fix(es):
* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)
* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)
* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)
* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)
* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)
The CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. \n\nRed Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)\n\n* It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)\n\n* It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)\n\n* It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)\n\n* It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)\n\nThe CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2018:0319",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.3"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jboss.amq.broker\u0026version=6.3.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/",
"url": "https://access.redhat.com/documentation/en/red-hat-jboss-fuse/"
},
{
"category": "external",
"summary": "1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "ENTESB-7397",
"url": "https://issues.redhat.com/browse/ENTESB-7397"
},
{
"category": "external",
"summary": "ENTESB-7398",
"url": "https://issues.redhat.com/browse/ENTESB-7398"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0319.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R6 security and bug fix update",
"tracking": {
"current_release_date": "2025-09-10T14:21:48+00:00",
"generator": {
"date": "2025-09-10T14:21:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2018:0319",
"initial_release_date": "2018-02-14T19:29:46+00:00",
"revision_history": [
{
"date": "2018-02-14T19:29:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2018-02-14T19:29:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:21:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss A-MQ 6.3",
"product": {
"name": "Red Hat JBoss A-MQ 6.3",
"product_id": "Red Hat JBoss A-MQ 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_amq:6.3"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.3",
"product": {
"name": "Red Hat JBoss Fuse 6.3",
"product_id": "Red Hat JBoss Fuse 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Hooman Broujerdi"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2017-2617",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2017-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1419363"
}
],
"notes": [
{
"category": "description",
"text": "It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on a target machine where hawtio is deployed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Hawtio: Unrestricted file upload leads to RCE",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-2617"
},
{
"category": "external",
"summary": "RHBZ#1419363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419363"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-2617",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2617"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2617"
}
],
"release_date": "2017-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Hawtio: Unrestricted file upload leads to RCE"
},
{
"cve": "CVE-2017-5662",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2017-04-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1443592"
}
],
"notes": [
{
"category": "description",
"text": "An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server\u0027s filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "batik: XML external entity processing vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The batik package is no longer used or required by the Red Hat Virtualization Manager. Red Hat recommends removing it after updating to Red Hat Virtualization 4.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-5662"
},
{
"category": "external",
"summary": "RHBZ#1443592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443592"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-5662",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5662"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5662"
}
],
"release_date": "2017-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "batik: XML external entity processing vulnerability"
},
{
"cve": "CVE-2017-8028",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2017-10-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1510968"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and when setting userSearch, authentication is allowed with an arbitrary password when the username is correct.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-8028"
},
{
"category": "external",
"summary": "RHBZ#1510968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1510968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-8028",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-8028"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8028"
}
],
"release_date": "2017-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password"
},
{
"cve": "CVE-2017-12633",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513382"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12633"
},
{
"category": "external",
"summary": "RHBZ#1513382",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513382"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12633",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12633"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-hessian: Apache Camel\u0027s Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks"
},
{
"cve": "CVE-2017-12634",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2017-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1513376"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-12634"
},
{
"category": "external",
"summary": "RHBZ#1513376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1513376"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-12634",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12634"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634"
}
],
"release_date": "2017-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-02-14T19:29:46+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss A-MQ 6.3",
"Red Hat JBoss Fuse 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-castor: Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks"
}
]
}
cnvd-2017-37564
Vulnerability from cnvd
Title: Apache Camel camel-castor组件反序列化远程代码执行漏洞
Description:
Apache Camel是美国阿帕奇（Apache）软件基金会的一套开源的基于Enterprise Integration Pattern(企业整合模式，简称EIP)的集成框架。该框架提供企业集成模式的Java对象（POJO）的实现，且通过应用程序接口来配置路由和中介的规则。camel-castor component是其中的一个O/R映射组件。
Apache Camel 2.19.4之前的2.x版本和2.20.1之前的2.20.x版本中的camel-castor组件存在安全漏洞。远程攻击者可利用该漏洞在受影响的应用程序上下文中执行任意代码或造成拒绝服务。
Severity: 高
Patch Name: Apache Camel camel-castor组件反序列化远程代码执行漏洞的补丁
Patch Description:
Apache Camel是美国阿帕奇（Apache）软件基金会的一套开源的基于Enterprise Integration Pattern(企业整合模式，简称EIP)的集成框架。该框架提供企业集成模式的Java对象（POJO）的实现，且通过应用程序接口来配置路由和中介的规则。camel-castor component是其中的一个O/R映射组件。
Apache Camel 2.19.4之前的2.x版本和2.20.1之前的2.20.x版本中的camel-castor组件存在安全漏洞。远程攻击者可利用该漏洞在受影响的应用程序上下文中执行任意代码或造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description:
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://issues.apache.org/jira/browse/CAMEL-11929
Reference: http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc
Impacted products
| Name | ['Apache Software Foundation Camel 2.*,<2.19.4', 'Apache Software Foundation Camel 2.20.*,<2.20.1'] |
|---|
{
"bids": {
"bid": {
"bidNumber": "101876"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-12634",
"cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12634"
}
},
"description": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002camel-castor component\u662f\u5176\u4e2d\u7684\u4e00\u4e2aO/R\u6620\u5c04\u7ec4\u4ef6\u3002\r\n\r\nApache Camel 2.19.4\u4e4b\u524d\u76842.x\u7248\u672c\u548c2.20.1\u4e4b\u524d\u76842.20.x\u7248\u672c\u4e2d\u7684camel-castor\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u6216\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
"discovererName": "Man Yue Mo",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://issues.apache.org/jira/browse/CAMEL-11929",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-37564",
"openTime": "2017-12-20",
"patchDescription": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002camel-castor component\u662f\u5176\u4e2d\u7684\u4e00\u4e2aO/R\u6620\u5c04\u7ec4\u4ef6\u3002\r\n\r\nApache Camel 2.19.4\u4e4b\u524d\u76842.x\u7248\u672c\u548c2.20.1\u4e4b\u524d\u76842.20.x\u7248\u672c\u4e2d\u7684camel-castor\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u6216\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Apache Camel camel-castor\u7ec4\u4ef6\u53cd\u5e8f\u5217\u5316\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Apache Software Foundation Camel 2.*,\u003c2.19.4",
"Apache Software Foundation Camel 2.20.*,\u003c2.20.1"
]
},
"referenceLink": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc",
"serverity": "\u9ad8",
"submitTime": "2017-11-21",
"title": "Apache Camel camel-castor\u7ec4\u4ef6\u53cd\u5e8f\u5217\u5316\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}
gsd-2017-12634
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-12634",
"description": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.",
"id": "GSD-2017-12634",
"references": [
"https://access.redhat.com/errata/RHSA-2018:0319"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-12634"
],
"details": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.",
"id": "GSD-2017-12634",
"modified": "2023-12-13T01:21:03.768141Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2017-11-15T00:00:00",
"ID": "CVE-2017-12634",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Camel",
"version": {
"version_data": [
{
"version_value": "2.19.0 to 2.19.3"
},
{
"version_value": "2.20.0"
},
{
"version_value": "The unsupported Camel 2.x (2.18 and earlier) versions may be also affected."
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Apache Camel\u0027s Castor unmarshalling operation is vulnerable to Remote Code Execution attacks"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2018:0319",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"name": "101876",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101876"
},
{
"name": "https://issues.apache.org/jira/browse/CAMEL-11929",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"name": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc",
"refsource": "CONFIRM",
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[2.0.0,2.19.4),[2.20.0]",
"affected_versions": "All versions starting from 2.0.0 before 2.19.4, version 2.20.0",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-502",
"CWE-937"
],
"date": "2019-05-24",
"description": "The camel-castor component is vulnerable to Java object deserialisation vulnerability. Deserializing untrusted data can lead to security flaws.",
"fixed_versions": [
"2.19.4",
"2.20.1"
],
"identifier": "CVE-2017-12634",
"identifiers": [
"CVE-2017-12634"
],
"not_impacted": "All versions before 2.0.0, all versions starting from 2.19.4 before 2.20.0, all versions after 2.20.0",
"package_slug": "maven/org.apache.camel/camel-castor",
"pubdate": "2017-11-15",
"solution": "Upgrade to versions 2.19.4, 2.20.1 or above.",
"title": "Deserialization of Untrusted Data",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2017-12634",
"http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc",
"http://www.securityfocus.com/bid/101876",
"https://issues.apache.org/jira/browse/CAMEL-11929"
],
"uuid": "8b1a1cc7-3f65-4abc-8d10-1c6963201a4f"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.19.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.20.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2017-12634"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://issues.apache.org/jira/browse/CAMEL-11929",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"name": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"name": "101876",
"refsource": "BID",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101876"
},
{
"name": "RHSA-2018:0319",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2019-05-24T11:29Z",
"publishedDate": "2017-11-15T15:29Z"
}
}
}
ghsa-vf4q-8mr7-5c5c
Vulnerability from github
Published
2018-10-16 23:05
Modified
2023-12-13 13:42
Severity ?
VLAI Severity ?
Summary
Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation
Details
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-castor"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.19.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-castor"
},
"ranges": [
{
"events": [
{
"introduced": "2.20.0"
},
{
"fixed": "2.20.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.20.0"
]
}
],
"aliases": [
"CVE-2017-12634"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:57:33Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.",
"id": "GHSA-vf4q-8mr7-5c5c",
"modified": "2023-12-13T13:42:09Z",
"published": "2018-10-16T23:05:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12634"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/2ae645e90edff3bcc1b958cb53ddc5e60a7f49fd"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/573ebd3de810cc7e239f175e1d2d6993f1f2ad08"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/ad3c1ce9d8300c339cfa7d0f4a4dea691a947988"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/adc06a78f04c8d798709a5818104abe5a8ae4b38"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/bdff8f3f3583e4f14cdaf24f2037e0fbef252630"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/c613905e95a3dab87158d9526aea9439f2de9621"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0319"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vf4q-8mr7-5c5c"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/CAMEL-11929"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…