GHSA-6g2w-257v-3c9f
Apache Camel information exposure vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.camel:camel-jira | >= 3.0.0-M3, < 3.14.9 | 3.14.9 |
| Maven | org.apache.camel:camel-jira | >= 3.15.0, < 3.18.8 | 3.18.8 |
| Maven | org.apache.camel:camel-jira | >= 3.20.0, < 3.20.6 | 3.20.6 |
| Maven | org.apache.camel:camel-jira | >= 4.0.0-M1, < 4.0.0-RC1 | 4.0.0-RC1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel. This issue affects Apache Camel from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.
Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-RC1
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-34442
- https://github.com/apache/camel/commit/b61d5b6be4f98b673dc977ad1bc6f004642644ab
- https://camel.apache.org/security/CVE-2023-34442.html
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-19421
- https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh