Description
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Camel
2.17.0 to 2.17.5affected2.18.0 to 2.18.2affectedThe unsupported Camel 2.x (2.16 and earlier) versions may be also affected.affected
References
- http://www.securityfocus.com/bid/97226 ↗
- https://access.redhat.com/errata/RHSA-2017:1832 ↗
- http://camel.apache.org/security-advisories.data/CVE-2017-5643.txt.asc?version=1&modificationDate=1489652454000&api=v2 ↗
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E ↗
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E ↗