Security Bulletin: Multiple vulnerabilities in Apache Camel core affect IBM Application Performance Management products

Summary

Apache Camel core is used by IBM Application Performance Management. The vulnerabilities in the product component have been addressed.

Vulnerability Details

CVEID:CVE-2014-0002
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in the XSLT component when parsing XML entities. By persuading a victim to open a specially-crafted XML document containing external entity references, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/91573 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID:CVE-2017-12633
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by Java object de-serialisation vulnerability in the camel-hessian component. By using deserialized untrusted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/135094 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2015-0264
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error related to the XPath handling of invalid XML Strings or invalid XML GenericFile objects. An attacker could exploit this vulnerability using an XML External Entity (XXE) declaration to read arbitrary files on the system.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101581 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID:CVE-2015-5344
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data by the camel-xstream component. An attacker could exploit this vulnerability using specially crafted data to execute arbitrary Java code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/110297 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2015-0263
**DESCRIPTION:**Apache Camel could allow a remote attacker to obtain sensitive information, caused by an error in the XML converter setup. An attacker could exploit this vulnerability using an SAXSource containing an XML External Entity (XXE) declaration to read arbitrary files on the system.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101580 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID:CVE-2013-4330
**DESCRIPTION:**Apache Camel could allow a remote attacker to execute arbitrary code on the system, caused by the improper handling of simple language expressions. An attacker could exploit this vulnerability to execute arbitrary code on the system with elevated privileges.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/87542 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Remediation/Fixes

IBM Cloud Application Performance Management, Base Private

IBM Cloud Application Performance Management, Advanced Private| 8.1.4|

The vulnerability can be remediated by applying the following 8.1.4.0-IBM-APM-SERVER-IF0014 or later server patch to the system where the Cloud APM server is installed: <https://www.ibm.com/support/pages/node/7028410&gt;

—|—|—

Workarounds and Mitigations

None