{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47323.json" } ], "title": "camel: camel-cxf-rest: camel-cxf-transport: camel-knative-http: camel-exec: camel-file: camel-undertow: Apache Camel: Remote Code Execution via header injection due to missing inbound filtering", "tracking": { "current_release_date": "2026-06-28T07:42:50+00:00", "generator": { "date": "2026-06-28T07:42:50+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "CVE-2026-47323", "initial_release_date": "2026-05-19T12:25:49.373000+00:00", "revision_history": [ { "date": "2026-05-19T12:25:49.373000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-04T04:22:19.473405+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-28T07:42:50+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Serverless", "product": { "name": "OpenShift Serverless", "product_id": "openshift_serverless", "product_identification_helper": { "cpe": "cpe:/a:redhat:serverless:1" } } } ], "category": "product_family", "name": "OpenShift Serverless" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel 4 for Quarkus 3", "product": { "name": "Red Hat build of Apache Camel 4 for Quarkus 3", "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_quarkus:3" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel 4 for Quarkus 3" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel for Spring Boot 4", "product": { "name": "Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_spring_boot:4" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel for Spring Boot 4" }, { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7", "product": { "name": "Red Hat Fuse 7", "product_id": "red_hat_fuse_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat Fuse 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product": { "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack", "product_identification_helper": { "cpe": "cpe:/a:redhat:jbosseapxp" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "branches": [ { "category": "product_name", "name": "Red Hat Process Automation 7", "product": { "name": "Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7" } } } ], "category": "product_family", "name": "Red Hat Process Automation 7" }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-ddb-streams-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-s3-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-s3-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-sns-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-sqs-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-aws-sqs-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-log-sink-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product": { "name": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product_id": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-eventing-integrations-timer-source-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9" } } }, { "category": "product_version", "name": "camel-cxf-transport", "product": { "name": "camel-cxf-transport", "product_id": "camel-cxf-transport", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel/camel-cxf-transport" } } }, { "category": "product_version", "name": "camel-cxf-rest", "product": { "name": "camel-cxf-rest", "product_id": "camel-cxf-rest", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel/camel-cxf-rest" } } }, { "category": "product_version", "name": "camel-cxf-rest-starter", "product": { "name": "camel-cxf-rest-starter", "product_id": "camel-cxf-rest-starter", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel.springboot/camel-cxf-rest-starter" } } }, { "category": "product_version", "name": "camel-cxf-transport-starter", "product": { "name": "camel-cxf-transport-starter", "product_id": "camel-cxf-transport-starter", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel.springboot/camel-cxf-transport-starter" } } }, { "category": "product_version", "name": "camel-knative-http", "product": { "name": "camel-knative-http", "product_id": "camel-knative-http", "product_identification_helper": { "purl": "pkg:maven/org.apache.camel/camel-knative-http" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9" }, "product_reference": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport as a component of Red Hat build of Apache Camel 4 for Quarkus 3", "product_id": "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-cxf-transport" }, "product_reference": "camel-cxf-transport", "relates_to_product_reference": "red_hat_build_of_apache_camel_4_for_quarkus_3" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-rest as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest" }, "product_reference": "camel-cxf-rest", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-rest-starter as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest-starter" }, "product_reference": "camel-cxf-rest-starter", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport" }, "product_reference": "camel-cxf-transport", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport-starter as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport-starter" }, "product_reference": "camel-cxf-transport-starter", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-knative-http as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:camel-knative-http" }, "product_reference": "camel-knative-http", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:camel-cxf-transport" }, "product_reference": "camel-cxf-transport", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport-starter as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:camel-cxf-transport-starter" }, "product_reference": "camel-cxf-transport-starter", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "camel-knative-http as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:camel-knative-http" }, "product_reference": "camel-knative-http", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-cxf-transport" }, "product_reference": "camel-cxf-transport", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "camel-knative-http as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-knative-http" }, "product_reference": "camel-knative-http", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "camel-cxf-transport as a component of Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7:camel-cxf-transport" }, "product_reference": "camel-cxf-transport", "relates_to_product_reference": "red_hat_process_automation_7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-47323", "cwe": { "id": "CWE-791", "name": "Incomplete Filtering of Special Elements" }, "discovery_date": "2026-05-19T14:02:59.056722+00:00", "flags": [ { "label": "inline_mitigations_already_exist", "product_ids": [ "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-cxf-transport" ] }, { "label": "vulnerable_code_not_present", "product_ids": [ "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-knative-http", "red_hat_fuse_7:camel-cxf-transport", "red_hat_fuse_7:camel-cxf-transport-starter", "red_hat_fuse_7:camel-knative-http", "red_hat_process_automation_7:camel-cxf-transport" ] }, { "label": "component_not_present", "product_ids": [ "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-cxf-transport", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-knative-http" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2479869" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Camel. An unauthenticated attacker could inject Camel-internal headers via HTTP requests to CXF-RS or CXF-SOAP endpoints due to missing inbound filtering in the `HeaderFilterStrategy` implementations. This allows the attacker to override configured values when messages are forwarded to header-driven components like camel-exec or camel-file, potentially leading to remote code execution or arbitrary file writes.", "title": "Vulnerability description" }, { "category": "summary", "text": "camel: camel-cxf-rest: camel-cxf-transport: camel-knative-http: camel-exec: camel-file: camel-undertow: Apache Camel: Remote Code Execution via header injection due to missing inbound filtering", "title": "Vulnerability summary" }, { "category": "other", "text": "This Critical flaw in Apache Camel allows an unauthenticated attacker to achieve remote code execution or arbitrary file writes. The vulnerability arises from insufficient inbound header filtering in CXF-RS, CXF-SOAP, and Knative HTTP endpoints. When these endpoints process HTTP requests containing specially crafted Camel-internal headers and forward them to header-driven components such as `camel-exec` or `camel-file`, the injected headers can override legitimate configurations, leading to severe system compromise. This impacts Red Hat build of Apache Camel, Enterprise Application Platform, OpenShift Serverless, and Red Hat JBoss Fuse deployments utilizing these affected components.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9" ], "known_not_affected": [ "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-knative-http", "red_hat_fuse_7:camel-cxf-transport", "red_hat_fuse_7:camel-cxf-transport-starter", "red_hat_fuse_7:camel-knative-http", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-cxf-transport", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-knative-http", "red_hat_process_automation_7:camel-cxf-transport" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-47323" }, { "category": "external", "summary": "RHBZ#2479869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479869" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47323", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47323" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47323", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47323" }, { "category": "external", "summary": "https://camel.apache.org/security/CVE-2026-47323.html", "url": "https://camel.apache.org/security/CVE-2026-47323.html" } ], "release_date": "2026-05-19T12:25:49.373000+00:00", "remediations": [ { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-knative-http", "red_hat_fuse_7:camel-cxf-transport", "red_hat_fuse_7:camel-cxf-transport-starter", "red_hat_fuse_7:camel-knative-http", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-cxf-transport", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-knative-http", "red_hat_process_automation_7:camel-cxf-transport" ] } ], "threats": [ { "category": "impact", "details": "Critical", "product_ids": [ "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "openshift_serverless:openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "red_hat_build_of_apache_camel_4_for_quarkus_3:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-rest-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-cxf-transport-starter", "red_hat_build_of_apache_camel_for_spring_boot_4:camel-knative-http", "red_hat_fuse_7:camel-cxf-transport", "red_hat_fuse_7:camel-cxf-transport-starter", "red_hat_fuse_7:camel-knative-http", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-cxf-transport", "red_hat_jboss_enterprise_application_platform_expansion_pack:camel-knative-http", "red_hat_process_automation_7:camel-cxf-transport" ] } ], "title": "camel: camel-cxf-rest: camel-cxf-transport: camel-knative-http: camel-exec: camel-file: camel-undertow: Apache Camel: Remote Code Execution via header injection due to missing inbound filtering" } ] }