Homepage

org.apache.camel:camel-smooks@4.17.0

  • latest version

    4.23.0

  • latest non vulnerable version

    4.23.0

  • first published

    10 months ago

  • latest version published

    11 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.camel:camel-smooks package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    XML External Entity (XXE) Injection

    Affected versions of this package are vulnerable to XML External Entity (XXE) Injection through XML parsing in the Smooks data format (SmooksDataFormat) and smooks: component (SmooksProcessor) in camel-smooks. An attacker can read files accessible to the Camel process or make it send requests to internal network hosts by supplying an XML message body with an external entity declaration; when Smooks uses its default reader, it resolves the entity during unmarshalling and includes the resolved content in the result returned on InOut routes.

    Notes

    • The parsing step is affected only when Smooks uses its default XML reader; configurations declaring their own reader, such as EDI, CSV, JSON, or a custom reader, are not affected.

    Workarounds

    • Do not apply camel-smooks to XML received from untrusted senders; this prevents attacker-supplied external entities from being resolved to read local files or make requests to internal hosts.

    How to fix XML External Entity (XXE) Injection?

    Upgrade org.apache.camel:camel-smooks to version 4.18.5, 4.22.1 or higher.

    [4.7.0,4.18.5)[4.19.0,4.22.1)
    Go back to all versions of this package