There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects
    Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.
    Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x
    releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker
    to include Camel specific headers that for some Camel components can alter the behaviours such as the
    camel-bean component, to call another method on the bean, than was coded in the application. In the camel-
    jms component, then a malicious header can be used to send the message to another queue (on the same
    broker) than was coded in the application. This could also be seen by using the camel-exec component The
    attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications
    that are directly connected to the internet via HTTP, then an attacker could include malicious HTTP
    headers in the HTTP requests that are send to the Camel application. All the known Camel HTTP component
    such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be
    vulnerable out of the box. In these conditions an attacker could be able to forge a Camel header name and
    make the bean component invoking other methods in the same bean. In terms of usage of the default header
    filter strategy the list of components using that is: * camel-activemq * camel-activemq6 * camel-amqp *
    camel-aws2-sqs * camel-azure-servicebus * camel-cxf-rest * camel-cxf-soap * camel-http * camel-jetty *
    camel-jms * camel-kafka * camel-knative * camel-mail * camel-nats * camel-netty-http * camel-platform-http
    * camel-rest * camel-sjms * camel-spring-rabbitmq * camel-stomp * camel-tahu * camel-undertow * camel-xmpp
    The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting
    with "Camel", "camel", or "org.apache.camel.". Mitigation: You can easily work around this in your Camel
    applications by removing the headers in your Camel routes. There are many ways of doing this, also
    globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel,
    cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
    (CVE-2025-27636)

遠端主機上執行的 Apache Camel 版本為 3.22.4 之前的 3.10.0 版、4.8.5 之前的 4.8.x 版，或是 4.10.2 之前的 4.10.x 版。因此受到一個訊息標頭插入弱點影響：

  - 在特定情況下，Apache Camel 元件中的繞過/插入攻擊弱點。此問題影響以下版本的 Apache Camel：4.10.0 至 <= 4.10.1、4.8.0 至 <= 4.8.4、3.10.0 至 <= 3.22.3。建議使用者升級至 4.10.x LTS 的 4.10.2 版、4.8.x LTS 的 4.8.5 版以及 3.x 的  3.22.4 版本。此弱點存在於 Camel 的預設傳入標頭篩選器中，可允許攻擊者納入 Camel 專屬標頭，讓某些 Camel 元件可改變行為 (例如 Camel-bean 元件)，呼叫 bean 上的另一種方法，而不是在應用程式中編碼。(CVE-2025-27636)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上运行的 Apache Camel 版本为 3.22.4 之前的 3.10.0 版、4.8.5 之前的 4.8.x 版，或是 4.10.2 之前的 4.10.x 版。因此，它受到受到消息标头注入漏洞的影响：

  - Apache Camel 组件在特定情况下存在的绕过/注入漏洞。此问题影响以下 Apache Camel 版本：4.10.0 至 <= 4.10.1、4.8.0 至 <= 4.8.4、3.10.0 至 <= 3.22.3。建议用户升级到版本 4.10.2 至 4.10.x LTS、4.8.5 至 4.8.x LTS 和 3.22.4 至 3.x。此漏洞存在于 Camel 的默认传入标头过滤器中，该过滤器允许攻击者包含 Camel 特定标头；对于某些 Camel 组件（例如 camel-bean 组件），这些标头可以改变行为，以调用 bean 上的另一个方法，而不是在应用程序中编码的方法。(CVE-2025-27636)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモートホストの Apache Camel のバージョンは、3.22.4 より前の 3.10.0、4.8.5 より前の 4.8.x、または 4.10.2 より前の 4.10.x です。したがって、メッセージヘッダーインジェクション脆弱性の影響を受けます。

  - 特定の条件下での Apache Camel コンポーネントのバイパス/インジェクションの脆弱性。この問題は、4.10.0 から 4.10.1 まで、4.8.0 から 4.8.4 まで、3.10.0 から 3.22.3 までの Apache Camel に影響します。ユーザーは、4.10.x LTS の場合はバージョン 4.10.2 に、4.8.x LTS の場合はバージョン 4.8.5 に、3.x リリースの場合はバージョン 3.22.4 にアップグレードすることをお勧めします。この脆弱性は Camel の既定の受信ヘッダー フィルターに存在し、攻撃者が Camel 固有のヘッダーを含めることができるため、一部の Camel コンポーネントの動作が変更され、camel-bean コンポーネントがアプリケーションでコード化されたものとは別のメソッドを Bean 上で呼び出す可能性があります。(CVE-2025-27636)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Apache Camel on the remote host is 3.10.0 prior to 3.22.4, 4.8.x prior to 4.8.5, or 4.10.x prior to 4.10.2. It is, therefore, affected by a message header injection vulnerability:

  - Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache     Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are     recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This     vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel     specific headers that for some Camel components can alter the behaviours such as the camel-bean component, to call     another method on the bean, than was coded in the application. (CVE-2025-27636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
421082	SCA: security update for org.apache.camel:camel-support (GHSA-2c2h-2855-mf97)	Tenable Cloud Security	SCA Checks	2025/3/11	2026/7/2	medium
421082	SCA: security update for org.apache.camel:camel-support (GHSA-2c2h-2855-mf97)	Tenable Self-Hosted Container Security	SCA Checks	2025/3/11	2026/7/2	medium
232840	Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 訊息標頭插入 (CVE-2025-27636)	Nessus	Misc.	2025/3/18	2025/3/18	medium
232840	Apache Camel 3.10.0 < 3.22.4/4.8.x < 4.8.5/4.10.x < 4.10.2 消息标头注入 (CVE-2025-27636)	Nessus	Misc.	2025/3/18	2025/3/18	medium
232840	Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 メッセージヘッダーインジェクション (CVE-2025-27636)	Nessus	Misc.	2025/3/18	2025/3/18	medium
232840	Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)	Nessus	Misc.	2025/3/18	2025/3/18	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium