From 590e9064c919f91059f7710e546cbf4039b20e14 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 10 Mar 2025 20:51:35 +0000 Subject: [PATCH] Publish Advisories GHSA-2c2h-2855-mf97 GHSA-2c2h-2855-mf97 --- .../GHSA-2c2h-2855-mf97.json | 127 ++++++++++++++++++ .../GHSA-2c2h-2855-mf97.json | 41 ------ 2 files changed, 127 insertions(+), 41 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json diff --git a/advisories/github-reviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json b/advisories/github-reviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json new file mode 100644 index 00000000000..437b88746e3 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json @@ -0,0 +1,127 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2c2h-2855-mf97", + "modified": "2025-03-10T20:49:46Z", + "published": "2025-03-09T15:31:19Z", + "aliases": [ + "CVE-2025-27636" + ], + "summary": "Apache Camel: Camel Message Header Injection via Improper Filtering", + "details": "Bypass/Injection vulnerability in Apache Camel-Bean component under particular conditions.\n\nThis issue affects Apache Camel: from 4.9.0 through <= 4.10.1, from 4.2.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.\n\nUsers are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.\n\nThis vulnerability is only present in the following situation. The user is using one of the following HTTP Servers via one the of the following Camel components\n\n * camel-servlet\n * camel-jetty\n * camel-undertow\n * camel-platform-http\n * camel-netty-http\n\n\nand in the route, the exchange will be routed to a camel-bean producer. So ONLY camel-bean component is affected. In particular: \n\n * The bean invocation (is only affected if you use any of the above together with camel-bean component).\n\n * The bean that can be called, has more than 1 method implemented.\nIn these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean.\n\nThe vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with \"Camel\", \"camel\", or \"org.apache.camel.\". \n\n\nMitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like \"cAmel, cAMEL\" etc, or in general everything not starting with \"Camel\", \"camel\" or \"org.apache.camel.\".", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-support" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.10.0" + }, + { + "fixed": "3.22.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-support" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.8.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-support" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.9.0" + }, + { + "fixed": "4.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27636" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/23a833eec6131a3cdce6e4b1b40b3ac2035b6adf" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/45a6b74f7f8af8fd58f197566938a9534392a624" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/commit/9b59f350f6bc6718145529426e8e2d2e5e15bc45" + }, + { + "type": "WEB", + "url": "https://camel.apache.org/security/CVE-2025-27636.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/camel" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/blob/camel-4.9.0/core/camel-support/src/main/java/org/apache/camel/support/DefaultHeaderFilterStrategy.java" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CAMEL-21828" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/03/09/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-178" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T20:49:46Z", + "nvd_published_at": "2025-03-09T13:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json b/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json deleted file mode 100644 index 422741be9a8..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2c2h-2855-mf97", - "modified": "2025-03-10T15:30:46Z", - "published": "2025-03-09T15:31:19Z", - "aliases": [ - "CVE-2025-27636" - ], - "details": "Bypass/Injection vulnerability in Apache Camel-Bean component under particular conditions.\n\nThis issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.\n\nUsers are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.\n\nThis vulnerability is only present in the following situation. The user is using one of the following HTTP Servers via one the of the following Camel components\n\n * camel-servlet\n * camel-jetty\n * camel-undertow\n * camel-platform-http\n * camel-netty-http\n\n\nand in the route, the exchange will be routed to a camel-bean producer. So ONLY camel-bean component is affected. In particular: \n\n * The bean invocation (is only affected if you use any of the above together with camel-bean component).\n\n * The bean that can be called, has more than 1 method implemented.\nIn these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean.\n\nThe vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with \"Camel\", \"camel\", or \"org.apache.camel.\". \n\n\nMitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like \"cAmel, cAMEL\" etc, or in general everything not starting with \"Camel\", \"camel\" or \"org.apache.camel.\".", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27636" - }, - { - "type": "WEB", - "url": "https://camel.apache.org/security/CVE-2025-27636.html" - }, - { - "type": "WEB", - "url": "https://issues.apache.org/jira/browse/CAMEL-21828" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/03/09/1" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-09T13:15:34Z" - } -} \ No newline at end of file