Bug 2227782 (CVE-2023-34442)

Summary:	CVE-2023-34442 camel-jira: Temporary file information disclosure in Camel-Jira
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, chazlett, fmongiar, gmalinko, janstey, jnethert, jpoth, pdelbell, peholase, pjindal, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	camel-jira 3.14.9, camel-jira 3.18.8, camel-jira 3.20.6, camel-jira 3.21.0	Doc Type:	---
Doc Text:	A flaw was found in the camel-jira package. The package was creating a file directly instead of using Files.createTempFile in FileConverter, which could lead to the unexpected creation of a file in a vulnerable directory, giving access to unauthorized actors.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2221277

Description Patrick Del Bello 2023-07-31 12:51:24 UTC

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.

Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1


https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh