Major Description
CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
Refer
https://www.openwall.com/lists/oss-security/2020/05/14/7 and
https://github.com/apache/camel/pull/3692
Can you please upgrade Apache ActiveMQ to use non vlnerable Apache Camel 3.2.0?
Following is the information from Sonatype Nexus Audior reported issue on AMQ 5.15.13
Description :
Severity : CVE CVSS 3: 7.5Sonatype CVSS 3: 7.5
Weakness : CVE CWE: 20
Source : National Vulnerability Database
Categories : Data
Description from CVE : Apache Camels JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Explanation : This issue has undergone the Sonatype Fast-Track process. For more information, please see the Sonatype Knowledge Base Guide.
Advisories : Project: https://github.com/apache/camel/pull/3692
CVSS Details : CVE CVSS 3: 7.5CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE : CVE-2020-11971
URL : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11971
Remediation : This component does not have any non-vulnerable Version. Please contact the vendor to get this vulnerability fixed.
