ID

VAR-202005-0324


CVE

CVE-2020-11971


TITLE

Apache Camel Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-005722

DESCRIPTION

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0. Apache Camel There is an input verification vulnerability in.Information may be obtained. Apache Camel is an open source integration framework based on the Enterprise Integration Pattern (EIP) of the Apache Software Foundation. The framework provides the implementation of Java objects (POJO) of the enterprise integration pattern, and configures the rules of routing and mediation through application programming interfaces. An attacker could exploit this vulnerability to obtain sensitive information through a specially crafted request. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Fuse 7.8.0 release and security update Advisory ID: RHSA-2020:5568-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2020:5568 Issue date: 2020-12-16 CVE Names: CVE-2018-1000873 CVE-2019-0205 CVE-2019-0210 CVE-2019-2692 CVE-2019-3773 CVE-2019-3774 CVE-2019-10202 CVE-2019-10219 CVE-2019-11777 CVE-2019-12406 CVE-2019-12423 CVE-2019-13990 CVE-2019-14900 CVE-2019-17566 CVE-2019-17638 CVE-2019-19343 CVE-2020-1714 CVE-2020-1719 CVE-2020-1950 CVE-2020-1960 CVE-2020-5398 CVE-2020-7226 CVE-2020-9488 CVE-2020-9489 CVE-2020-10683 CVE-2020-10740 CVE-2020-11612 CVE-2020-11971 CVE-2020-11972 CVE-2020-11973 CVE-2020-11980 CVE-2020-11989 CVE-2020-11994 CVE-2020-13692 CVE-2020-13933 CVE-2020-14326 ==================================================================== 1. Summary: A minor version update (from 7.7 to 7.8) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.8.0 serves as a replacement for Red Hat Fuse 7.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * libquartz: XXE attacks via job description (CVE-2019-13990) * jetty: double release of resource can lead to information disclosure (CVE-2019-17638) * keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714) * springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application (CVE-2020-5398) * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740) * camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution (CVE-2020-11972) * camel: Netty enables Java deserialization by default which could leed to remote code execution (CVE-2020-11973) * shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass (CVE-2020-11989) * camel: server-side template injection and arbitrary file disclosure on templating components (CVE-2020-11994) * postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692) * shiro: specially crafted HTTP request may cause an authentication bypass (CVE-2020-13933) * RESTEasy: Caching routes in RootNode may result in DoS (CVE-2020-14326) * jackson-modules-java8: DoS due to an Improper Input Validation (CVE-2018-1000873) * thrift: Endless loop when feed with specific input data (CVE-2019-0205) * thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210) * mysql-connector-java: privilege escalation in MySQL connector (CVE-2019-2692) * spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources (CVE-2019-3773) * spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources (CVE-2019-3774) * codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202) * hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219) * org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library (CVE-2019-11777) * cxf: does not restrict the number of message attachments (CVE-2019-12406) * cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423) * hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900) * batik: SSRF via "xlink:href" (CVE-2019-17566) * Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely (CVE-2019-19343) * Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain (CVE-2020-1719) * apache-flink: JMX information disclosure vulnerability (CVE-2020-1960) * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226) * tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers (CVE-2020-9489) * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683) * netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612) * camel: DNS Rebinding in JMX Connector could result in remote command execution (CVE-2020-11971) * karaf: A remote client could create MBeans from arbitrary URLs (CVE-2020-11980) * tika: excessive memory usage in PSDParser (CVE-2020-1950) * log4j: improper validation of certificate with host mismatch in SMTP appender (CVE-2020-9488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.8.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1665601 - CVE-2018-1000873 jackson-modules-java8: DoS due to an Improper Input Validation 1666499 - CVE-2019-14900 hibernate: SQL injection issue in Hibernate ORM 1670593 - CVE-2019-3773 spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources 1670597 - CVE-2019-3774 spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources 1694235 - CVE-2020-10683 dom4j: XML External Entity vulnerability in default SAX parser 1703402 - CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector 1705975 - CVE-2020-1714 keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution 1731271 - CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities 1738673 - CVE-2019-10219 hibernate-validator: safeHTML validator allows XSS 1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol 1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data 1780445 - CVE-2019-19343 Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely 1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain 1797006 - CVE-2019-12423 cxf: OpenId Connect token service does not properly validate the clientId 1799475 - CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application 1801149 - CVE-2019-13990 libquartz: XXE attacks via job description 1801380 - CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation 1816170 - CVE-2019-12406 cxf: does not restrict the number of message attachments 1816216 - CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes 1822759 - CVE-2020-1950 tika: excessive memory usage in PSDParser 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender 1834512 - CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans 1848126 - CVE-2020-1960 apache-flink: JMX information disclosure vulnerability 1848433 - CVE-2020-11971 camel: DNS Rebinding in JMX Connector could result in remote command execution 1848464 - CVE-2020-11972 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution 1848465 - CVE-2020-11973 camel: Netty enables Java deserialization by default which could leed to remote code execution 1848617 - CVE-2019-17566 batik: SSRF via "xlink:href" 1850042 - CVE-2020-9489 tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers 1850069 - CVE-2020-11989 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass 1850450 - CVE-2020-11980 karaf: A remote client could create MBeans from arbitrary URLs 1852985 - CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML 1855786 - CVE-2020-11994 camel: server-side template injection and arbitrary file disclosure on templating components 1855826 - CVE-2020-14326 RESTEasy: Caching routes in RootNode may result in DoS 1864680 - CVE-2019-17638 jetty: double release of resource can lead to information disclosure 1869860 - CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass 1879743 - CVE-2019-11777 org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library 5. References: https://access.redhat.com/security/cve/CVE-2018-1000873 https://access.redhat.com/security/cve/CVE-2019-0205 https://access.redhat.com/security/cve/CVE-2019-0210 https://access.redhat.com/security/cve/CVE-2019-2692 https://access.redhat.com/security/cve/CVE-2019-3773 https://access.redhat.com/security/cve/CVE-2019-3774 https://access.redhat.com/security/cve/CVE-2019-10202 https://access.redhat.com/security/cve/CVE-2019-10219 https://access.redhat.com/security/cve/CVE-2019-11777 https://access.redhat.com/security/cve/CVE-2019-12406 https://access.redhat.com/security/cve/CVE-2019-12423 https://access.redhat.com/security/cve/CVE-2019-13990 https://access.redhat.com/security/cve/CVE-2019-14900 https://access.redhat.com/security/cve/CVE-2019-17566 https://access.redhat.com/security/cve/CVE-2019-17638 https://access.redhat.com/security/cve/CVE-2019-19343 https://access.redhat.com/security/cve/CVE-2020-1714 https://access.redhat.com/security/cve/CVE-2020-1719 https://access.redhat.com/security/cve/CVE-2020-1950 https://access.redhat.com/security/cve/CVE-2020-1960 https://access.redhat.com/security/cve/CVE-2020-5398 https://access.redhat.com/security/cve/CVE-2020-7226 https://access.redhat.com/security/cve/CVE-2020-9488 https://access.redhat.com/security/cve/CVE-2020-9489 https://access.redhat.com/security/cve/CVE-2020-10683 https://access.redhat.com/security/cve/CVE-2020-10740 https://access.redhat.com/security/cve/CVE-2020-11612 https://access.redhat.com/security/cve/CVE-2020-11971 https://access.redhat.com/security/cve/CVE-2020-11972 https://access.redhat.com/security/cve/CVE-2020-11973 https://access.redhat.com/security/cve/CVE-2020-11980 https://access.redhat.com/security/cve/CVE-2020-11989 https://access.redhat.com/security/cve/CVE-2020-11994 https://access.redhat.com/security/cve/CVE-2020-13692 https://access.redhat.com/security/cve/CVE-2020-13933 https://access.redhat.com/security/cve/CVE-2020-14326 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.8.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX9n5stzjgjWX9erEAQhLEA/+P1hIAPgSOz6uLDvvZvm73qyxbuISD92X kJ158V+IX64dMlCuUCfFFKiuRCsDzhCSi52P4m8q06OskS1QndEmjfSixER/pG8X YJKatVpbxbVE3V2U/wRRfrG/j18UhwNatS3VouvdKOXwQewWb0TaGwGJ9wdZLDMd 7owlOwqQ1dOh2AMS3NWAeNBSzQtfk0GUb61+V1WRdCBs/PII1roRJyZEGEBsIZtg z66CncAjMwL7zj/ZRYK7ogWL20HwMgCQ3oAHo1ENM5k6o7scqRArhMKPthdtF88y AwqPo8ocQCE5JB66tbUie6ze2sYPgBflWSJ0zEv3suyUbzLyO2d1utzyXn24ffYN 0F1gY0YFsLiNRZPfdtGx+cPB5dlBOnnJUOTXA1e87CXohPRKqWuqQaxChGQY8CiH ZiWg2U/NLuBgg7SkL1Vm9Fqfe06roAfDQLL4nnd8BcRkmhNWG7KL2ve2fRDbfqKT RH9x3XbHhD0cfvTFaEj0qVojsSCjVrE+SeJdluDY21kf0OxspVDMffQ0WD2cNVFh PgaQJt4ItTfkanw7cKs1GNH4WjMmpuAfe2lzR3JBLlkSvf7iqiPVIrIY+NAOHYG0 Mtx6d3mbwr91KjGg3lXOoM+tTFjOiCZMr/k7WIt3VllJpBP18cbAXeGtEmpMg+jA f8t2frnd7kM=jGVK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.89

sources: NVD: CVE-2020-11971 // JVNDB: JVNDB-2020-005722 // VULHUB: VHN-164603 // VULMON: CVE-2020-11971 // PACKETSTORM: 160562

AFFECTED PRODUCTS

vendor:oraclemodel:flexcube private bankingscope:eqversion:12.0.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.3.0.0

Trust: 1.0

vendor:oraclemodel:flexcube private bankingscope:eqversion:12.1.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.4.0.0

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0

Trust: 1.0

vendor:oraclemodel:communications diameter intelligence hubscope:lteversion:8.1.0

Trust: 1.0

vendor:apachemodel:camelscope:gteversion:2.22.0

Trust: 1.0

vendor:apachemodel:camelscope:lteversion:3.1.0

Trust: 1.0

vendor:oraclemodel:communications diameter intelligence hubscope:gteversion:8.0.0

Trust: 1.0

vendor:oraclemodel:communications diameter intelligence hubscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:communications diameter intelligence hubscope:lteversion:8.2.3

Trust: 1.0

vendor:apachemodel:camelscope:eqversion:2.22.x

Trust: 0.8

vendor:apachemodel:camelscope:eqversion:2.23.x

Trust: 0.8

vendor:apachemodel:camelscope:eqversion:2.24.x

Trust: 0.8

vendor:apachemodel:camelscope:eqversion:2.25.0

Trust: 0.8

vendor:apachemodel:camelscope:eqversion:3.0.0 から 3.1.0

Trust: 0.8

sources: JVNDB: JVNDB-2020-005722 // NVD: CVE-2020-11971

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-11971
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-005722
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202005-787
value: HIGH

Trust: 0.6

VULHUB: VHN-164603
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-11971
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-11971
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-005722
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-164603
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-11971
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-005722
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-164603 // VULMON: CVE-2020-11971 // JVNDB: JVNDB-2020-005722 // CNNVD: CNNVD-202005-787 // NVD: CVE-2020-11971

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-20

Trust: 0.9

sources: VULHUB: VHN-164603 // JVNDB: JVNDB-2020-005722 // NVD: CVE-2020-11971

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 160562 // CNNVD: CNNVD-202005-787

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202005-787

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-005722

PATCH

title:Apache Camel security advisory: CVE-2020-11971url:https://camel.apache.org/security/CVE-2020-11971.html

Trust: 0.8

title:[camel-website] branch CVE-2020-11971-amend created (now 2a753f7)url:https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9@%3Ccommits.camel.apache.org%3E

Trust: 0.8

title:[camel-website] 02/02: CVE-2020-11971 - Amended fix versionurl:https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a@%3Ccommits.camel.apache.org%3E

Trust: 0.8

title:[jira] [Created] (AMQ-7492) CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0url:https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79@%3Cissues.activemq.apache.org%3E

Trust: 0.8

title:[camel-website] 01/02: CVE-2020-11971 - Amend the fix versionurl:https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4@%3Ccommits.camel.apache.org%3E

Trust: 0.8

title:Apache Camel Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=119190

Trust: 0.6

title:IBM: Security Bulletin: Apache Camel Core vulnerability in IBM Tivoli Monitoring Data Provider (CVE-2020-11971)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=ae75465cc95074ce0387aa0333f680fa

Trust: 0.1

title:Red Hat: Important: Red Hat Fuse 7.8.0 release and security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20205568 - Security Advisory

Trust: 0.1

sources: VULMON: CVE-2020-11971 // JVNDB: JVNDB-2020-005722 // CNNVD: CNNVD-202005-787

EXTERNAL IDS

db:NVDid:CVE-2020-11971

Trust: 2.7

db:OPENWALLid:OSS-SECURITY/2020/05/14/7

Trust: 2.6

db:PACKETSTORMid:160562

Trust: 0.8

db:JVNDBid:JVNDB-2020-005722

Trust: 0.8

db:CNNVDid:CNNVD-202005-787

Trust: 0.7

db:AUSCERTid:ESB-2020.4464

Trust: 0.6

db:AUSCERTid:ESB-2023.3599

Trust: 0.6

db:NSFOCUSid:47374

Trust: 0.6

db:VULHUBid:VHN-164603

Trust: 0.1

db:VULMONid:CVE-2020-11971

Trust: 0.1

sources: VULHUB: VHN-164603 // VULMON: CVE-2020-11971 // JVNDB: JVNDB-2020-005722 // PACKETSTORM: 160562 // CNNVD: CNNVD-202005-787 // NVD: CVE-2020-11971

REFERENCES

url:http://www.openwall.com/lists/oss-security/2020/05/14/7

Trust: 2.6

url:https://camel.apache.org/security/cve-2020-11971.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuapr2022.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpujan2021.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuoct2020.html

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-11971

Trust: 1.5

url:https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9%40%3ccommits.camel.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a%40%3ccommits.camel.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79%40%3cissues.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3cusers.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4%40%3ccommits.camel.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a%40%3cissues.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386%40%3cissues.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3cusers.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468%40%3cissues.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649%40%3cissues.activemq.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d3753124c79@%3cissues.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537f72db0a@%3cissues.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687dc168468@%3cissues.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed111994386@%3cissues.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/rc907a3d385a9c62416d686608e7241c864be8ef2ac16a3bdb0e33649@%3cissues.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3cusers.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3cusers.activemq.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e56819c4@%3ccommits.camel.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490aeae14a@%3ccommits.camel.apache.org%3e

Trust: 0.8

url:https://lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e54824749a8da9@%3ccommits.camel.apache.org%3e

Trust: 0.8

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11971

Trust: 0.8

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-apache-camel-shipped-with-ibm-netcool-omnibus-probe-dsl-factory-framework/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities-3/

Trust: 0.6

url:https://packetstormsecurity.com/files/160562/red-hat-security-advisory-2020-5568-01.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-camels-jmx-apache-camel-rabbitmq-and-apache-camel-netty-affects-ibm-operations-analytics-predictive-insights-cve-2020-11971-cve-2020-11972-cve/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.3599

Trust: 0.6

url:http://www.nsfocus.net/vulndb/47374

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.4464/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-management-is-vulnerable-to-apache-camel-core-vulnerabilities/

Trust: 0.6

url:https://vigilance.fr/vulnerability/apache-camel-information-disclosure-via-jmx-rebind-flaw-33641

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.ibm.com/blogs/psirt/security-bulletin-apache-camel-core-vulnerability-in-ibm-tivoli-monitoring-data-provider-cve-2020-11971/

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1719

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.fuse&version=7.8.0

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12406

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11973

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11972

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-2692

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-9488

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-1000873

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11989

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10740

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17566

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-13990

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11980

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11972

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1950

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12406

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11989

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-3774

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0210

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11612

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11980

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1960

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0205

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1393

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11971

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17566

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-1000873

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-7226

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10219

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-9489

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14326

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13692

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14900

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0210

Trust: 0.1

url:https://access.redhat.com/security/team/contact/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10202

Trust: 0.1

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10202

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10683

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-13990

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-3773

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13692

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10683

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11994

Trust: 0.1

url:https://bugzilla.redhat.com/):

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10219

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11973

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1714

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-5398

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-11777

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14900

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13933

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12423

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-3774

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10740

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-11612

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17638

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12423

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17638

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-2692

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-19343

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-11994

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-19343

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:5568

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-3773

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0205

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-11777

Trust: 0.1

sources: VULHUB: VHN-164603 // VULMON: CVE-2020-11971 // JVNDB: JVNDB-2020-005722 // PACKETSTORM: 160562 // CNNVD: CNNVD-202005-787 // NVD: CVE-2020-11971

CREDITS

Red Hat

Trust: 0.7

sources: PACKETSTORM: 160562 // CNNVD: CNNVD-202005-787

SOURCES

db:VULHUBid:VHN-164603
db:VULMONid:CVE-2020-11971
db:JVNDBid:JVNDB-2020-005722
db:PACKETSTORMid:160562
db:CNNVDid:CNNVD-202005-787
db:NVDid:CVE-2020-11971

LAST UPDATE DATE

2024-08-14T12:54:11.116000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-164603date:2022-05-12T00:00:00
db:VULMONid:CVE-2020-11971date:2022-05-12T00:00:00
db:JVNDBid:JVNDB-2020-005722date:2020-06-19T00:00:00
db:CNNVDid:CNNVD-202005-787date:2023-06-25T00:00:00
db:NVDid:CVE-2020-11971date:2023-11-07T03:15:16.637

SOURCES RELEASE DATE

db:VULHUBid:VHN-164603date:2020-05-14T00:00:00
db:VULMONid:CVE-2020-11971date:2020-05-14T00:00:00
db:JVNDBid:JVNDB-2020-005722date:2020-06-19T00:00:00
db:PACKETSTORMid:160562date:2020-12-16T18:17:52
db:CNNVDid:CNNVD-202005-787date:2020-05-14T00:00:00
db:NVDid:CVE-2020-11971date:2020-05-14T17:15:12.053