~ / search / GHSA-x9fv-c87w-55wc

GHSA-x9fv-c87w-55wc

Improper Control of Generation of Code in Apache Camel

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-4330

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.camel:camel-core < 2.9.7 2.9.7
Maven org.apache.camel:camel-core >= 2.10.0, < 2.10.7 2.10.7
Maven org.apache.camel:camel-core >= 2.11.0, < 2.11.2 2.11.2
Maven org.apache.camel:camel-core >= 2.12.0, < 2.12.1 2.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

References

External links from the advisory. They lead to third-party sites.