From 551291da258631127727bc8f7a8d8c3bb3858fef Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 19 Dec 2023 22:23:46 +0000
Subject: [PATCH] Publish GHSA-vq9j-jh62-5hmp

---
 .../GHSA-vq9j-jh62-5hmp.json                  | 26 ++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2018/10/GHSA-vq9j-jh62-5hmp/GHSA-vq9j-jh62-5hmp.json b/advisories/github-reviewed/2018/10/GHSA-vq9j-jh62-5hmp/GHSA-vq9j-jh62-5hmp.json
index 2919ec5e829..55f4694b579 100644
--- a/advisories/github-reviewed/2018/10/GHSA-vq9j-jh62-5hmp/GHSA-vq9j-jh62-5hmp.json
+++ b/advisories/github-reviewed/2018/10/GHSA-vq9j-jh62-5hmp/GHSA-vq9j-jh62-5hmp.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vq9j-jh62-5hmp",
-  "modified": "2022-04-26T21:36:33Z",
+  "modified": "2023-12-19T22:22:28Z",
   "published": "2018-10-16T23:13:11Z",
   "aliases": [
     "CVE-2017-5643"
   ],
-  "summary": "Apache Camel using an outdated vulnerable JSON-lib library",
-  "details": "Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.",
+  "summary": "Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.",
+  "details": "Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE).  The vulnerability is not given for SAX or StAX sources.\n\nMitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3. \n\nThe JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -59,6 +59,18 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5643"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3be"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046da"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5b"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2017:1832"
@@ -67,6 +79,14 @@
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-vq9j-jh62-5hmp"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/camel/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.apache.org/jira/browse/CAMEL-10894"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"