Release Date: 2019-05-21
Updated: 2019-05-27
Affected Systems:
Apache Group Camel < 2.24.0
Systems affected:
Apache Group Camel 2.24.0
description:
ID BUGTRAQ: 108 422
CVE (CAN) ID: CVE-2019-0188
the Apache Camel is a US Apache (Apache) Foundation, an open source software-based Enterprise Integration Pattern (enterprise integration model, referred to EIP) integration framework.
Apache Camel there is an XML external entity injection vulnerability allows an attacker to read arbitrary files installed on the server via a specially crafted request. The cause of vulnerability is the use of outdated, vulnerable JSON-lib library.
<* Source: Takayoshi Isayama of the Secure by Mitsui Bussan at Directions, Inc is an
*>
recommendations:
Manufacturers patch:
the Apache Group
------------
new version of the current vendors have been released to fix this security issue, please go to the manufacturer's home page to download:
http://camel.apache.org/