CVE-2022-45046.txt.asc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CVE-2022-45046: LDAP Injection in camel-ldap (Retracted)

Severity: MEDIUM

Vendor: The Apache Software Foundation

Versions Affected: 3.0.0 up to 3.14.6, and 3.15.0 up to 3.18.3, and 3.19.0.

Description: LDAP Injection on camel-ldap component when using the filter option.

Mitigation: Users should upgrade to 3.18.4

The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-18696
refers to the various commits that resovoled the issue, and have more details.

Credit: This issue was discovered by 4ra1n from Chaitin Tech

The camel-spring-ldap component is not affected. Users could use move to the Camel-Spring-Ldap component.

The security vulnerability after further analysis is a false alarm (no security risk) and this CVE is retracted.
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmObGwUACgkQ406fOAL/
QQDo6gf6A4nmp8h/Romt1GRR24aPkizqXBEH7iEk8DSF35IePwGfvRsBAV472dP1
U/QrhmOpRgiLSYwXkahlZZn9yU2oeBrcjwiIbPBNmjYOwIhRaYib5yasJagsp1mh
roK1OQZc9ke3KccJtguTc8cwaV7S3YBzw8E6V4XuoPmFA69IdL0YEOjkgfNI9Csw
4YfL/mF8k2xLfqMeuMk0buShxW9bVDW6V3sAF3hG+QTGI1J/11z515vVU0frXB5f
l64+qnaBpG+vpeL/vJamzsRMNaslcj19rgQ5jwHZyD4sgiooHJJZsFUJFdHpV8Pa
3IZ5eFBti+VU0x2BqipaW0w4RAqb4A==
=Ppzl
-----END PGP SIGNATURE-----