Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen
WID-SEC-2023-1142 · first 04.05.2023 · updated 12.08.2026 · CVSS 9,8
What it is about
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel for Spring Boot ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- die Vertraulichkeit
- Verfügbarkeit
- Integrität zu gefährden
Am I affected?
Affected according to the BSI:
- Amazon Linux 2
- Red Hat Enterprise Linux
- Dell NetWorker
- Red Hat Integration Camel Extensions for Quarkus 1
- Red Hat Enterprise Linux Integration Camel for Spring Boot <3.20.1
- Red Hat OpenShift Container Platform <4.10.62
- Red Hat OpenShift Application Runtimes
- Red Hat Integration
- IBM InfoSphere Information Server
- Red Hat Enterprise Linux Apache Camel 1
- Dell Data Protection Advisor <19.12
- Dell Secure Connect Gateway <5.34.00.16
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Red Hat Enterprise Linux Integration Camel for Spring Boot 3.20.1
- Red Hat OpenShift Container Platform 4.10.62
- Dell Data Protection Advisor 19.12
- Dell Secure Connect Gateway 5.34.00.16
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- RedHat Security Advisory vom 2023-05-03 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3179 vom 2023-05-17 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3193 vom 2023-05-17 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3622 vom 2023-06-15 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3667 vom 2023-06-19 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3626 vom 2023-06-23 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3625 vom 2023-06-23 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3906 vom 2023-06-28 access.redhat.com
- Red Hat Security Advisory RHSA-2023:3954 vom 2023-06-29 access.redhat.com
- Amazon Linux Security Advisory ALAS2-2023-2165 vom 2023-07-26 alas.aws.amazon.com
- Red Hat Security Advisory RHSA-2023:4506 vom 2023-08-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4507 vom 2023-08-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4505 vom 2023-08-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4509 vom 2023-08-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4612 vom 2023-08-16 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4919 vom 2023-08-31 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4921 vom 2023-08-31 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4924 vom 2023-08-31 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4918 vom 2023-08-31 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4920 vom 2023-08-31 access.redhat.com
- Red Hat Security Advisory RHSA-2023:7670 vom 2023-12-06 access.redhat.com
- Dell Security Advisory DSA-2023-300 vom 2023-12-22 www.dell.com
- Dell Security Advisory DSA-2023-409 vom 2023-12-23 www.dell.com
- Amazon Linux Security Advisory ALAS-2024-1910 vom 2024-01-23 alas.aws.amazon.com
- Red Hat Security Advisory RHSA-2024:1027 vom 2024-02-28 access.redhat.com
and 7 more sources in the original advisory
CVE: CVE-2021-37533, CVE-2022-25857, CVE-2022-31777, CVE-2022-33681, CVE-2022-37865, CVE-2022-37866, CVE-2022-38398, CVE-2022-38648, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, CVE-2022-39368, CVE-2022-40146, CVE-2022-40150, CVE-2022-40151, CVE-2022-40152, CVE-2022-40156, CVE-2022-41704, CVE-2022-41852 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.