Bug 2150871 (CVE-2022-45046)

Summary:	CVE-2022-45046 camel-ldap: LDAP Injection on camel-ldap component when using the filter option
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, anstephe, avibelli, balejosg, bgeorges, chazlett, clement.escoffier, dandread, dkreling, fmongiar, gmalinko, gsmet, hamadhan, janstey, jnethert, jpavlik, jpoth, jwon, lthon, max.andersen, pdelbell, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	camel-ldap 3.14.6, camel-ldap 3.18.4	Doc Type:	If docs needed, set a value
Doc Text:	This flaw targets the camel-ldap package. According to the maintainers this CVE should be retracted soon.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-15 17:49:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2152798

Description Borja Tarraso 2022-12-05 13:32:33 UTC

camel-ldap component is vulnerable to LDAP Injection when using the filter option. The camel-spring-ldap component is not affected.

The versions affected are 3.0.0 up to 3.14.5, and 3.15.0 up to 3.18.3, and 3.19.0.

Comment 1 Patrick Del Bello 2022-12-14 16:04:02 UTC

This CVE came out as a false alarm and should be retracted soon. See more information in this link[1]

[1] https://issues.apache.org/jira/browse/CAMEL-18811?focusedCommentId=17647118&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17647118

Comment 2 Product Security DevOps Team 2022-12-15 17:49:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-45046