You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2020/05/14 13:09:15 UTC
[camel-website] branch master updated: Added CVE-2020-11971 (#363)
This is an automated email from the ASF dual-hosted git repository.
acosentino pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/master by this push:
new a9af1bf Added CVE-2020-11971 (#363)
a9af1bf is described below
commit a9af1bfb0458b0fdf05dfc70a96ffa90a2cfa491
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Thu May 14 15:08:53 2020 +0200
Added CVE-2020-11971 (#363)
---
content/security/CVE-2020-11971.md | 17 +++++++++++++++++
content/security/CVE-2020-11971.txt.asc | 27 +++++++++++++++++++++++++++
2 files changed, 44 insertions(+)
diff --git a/content/security/CVE-2020-11971.md b/content/security/CVE-2020-11971.md
new file mode 100644
index 0000000..a2783f6
--- /dev/null
+++ b/content/security/CVE-2020-11971.md
@@ -0,0 +1,17 @@
+---
+title: "Apache Camel Security Advisory - CVE-2020-11971"
+date: 2020-05-14T14:47:42+02:00
+url: /security/CVE-2020-11971.html
+draft: false
+type: security-advisory
+cve: CVE-2020-11971
+severity: MEDIUM
+summary: "Apache Camel JMX Rebind Flaw Vulnerability"
+description: "Apache Camel's JMS is vulnerable to Rebind Flaw"
+mitigation: "2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0"
+credit: "This issue was discovered by Colm O. HEigeartaigh <coheigea at apache dot org> from Apache Software Foundation and Jonathan Gallimore <jonathan dot gallimore at gmail dot com> from Tomitribe"
+affected: 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0
+fixed: 2.25.1, 3.2.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-14811 refers to the various commits that resovoled the issue, and have more details.
diff --git a/content/security/CVE-2020-11971.txt.asc b/content/security/CVE-2020-11971.txt.asc
new file mode 100644
index 0000000..b1fb788
--- /dev/null
+++ b/content/security/CVE-2020-11971.txt.asc
@@ -0,0 +1,27 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+CVE-2020-11971: Apache Camel JMX Rebind Flaw Vulnerability
+
+Severity: MEDIUM
+
+Vendor: The Apache Software Foundation
+
+Versions Affected: Camel 2.25.0, Camel 3.0.0 to 3.1.0. The unsupported Camel 2.x (2.24 and earlier) versions may be also affected.
+
+Description: Apache Camel's File is vulnerable to directory traversal
+
+Mitigation: 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0 The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-14811 refers to the various commits that resovoled the issue, and have more details.
+
+Credit: This issue was discovered by Colm O. HEigeartaigh <coheigea at apache dot org> from Apache Software Foundation and Jonathan Gallimore <jonathan dot gallimore at gmail dot com> from Tomitribe
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+iQEcBAEBAgAGBQJevUF0AAoJEONOnzgC/0EASloIAKLgfeTCfs3z/h1KVNNT2giG
+vqsQ2btCuE7ZEKsuRSU3AY+Q42MQk+0/XClqTiyXvJwQ8z3OcD9sGqxOfCQemJlr
+K0UO/PGTfSFHWUtEjAY1VuXqk7Lt1BHLDRAvNG8XXYNuG1YgKEtRcXTEXoWv2kYo
+nekM8ynRYdm6075OqfWJsLKOQBP2f3nR5fdIWgKKBapwjoORpoe228pm+gfgoUn2
+pzNJJibes7cvhV/AdIeGp27lj0BKMiT4W9aZCGzeBtm/E9C5tKUJwOA6gyf262ad
+rvMuVOlLa5lqE7lzksGcgjX3rFeCldCU64rshGfnIk8zlYQ0ChEi4KALIfuFr/E=
+=hswd
+-----END PGP SIGNATURE-----