CVE-2022-45046

Description

This flaw targets the camel-ldap package. According to the maintainers this CVE should be retracted soon.

Mitigation

Maintainers have added a documentation detail regarding LDAP Injection in Camel LDAP component. Please check the link for more information.

https://github.com/apache/camel/blob/3ea0740370bb436dcf70b91dcbfb4e2177fca797/components/camel-ldap/src/main/docs/ldap-component.adoc

Understanding the Weakness (CWE)

CWE-90

Confidentiality,Integrity,Availability

Technical Impact: Execute Unauthorized Code or Commands; Read Application Data; Modify Application Data

An attacker could include input that changes the LDAP query which allows unintended commands or code to be executed, allows sensitive data to be read or modified or causes other unintended behavior.

Acknowledgements

Red Hat would like to thank 4ra1n (Chaitin Tech) for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.