Red Hat Security Advisory

RHSA-2024:8339

Red Hat Integration Camel K 1.10.8 release and security update.

Released 2024-10-22 · Red Hat rating Important · View on Red Hat →

Fixed in

RHINT Camel-K 1.10.8

Fixes 3 records

TI-2024-15235 CVE-2024-23114 · GHSA-m43p-55rf-8c2j

Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository

MEDIUM 51

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01273 Published 2024-02-20 Fixed in 3.21.4, 3.22.1 +2 CWE-502

TI-2024-31848 CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

MEDIUM 47

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.03256 Published 2024-10-03 Partial fix · 1.11.4 CWE-502

TI-2024-18986 CVE-2024-28752 · GHSA-qmgx-j96g-4428

Apache CXF SSRF Vulnerability using the Aegis databinding

MEDIUM 47

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.02925 Published 2024-03-15 Partial fix · 4.0.4, 3.6.3 +1 CWE-918