Apache Camel security advisory
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components
Description
Server-Side Template Injection and arbitrary file disclosure on Camel templating components
Mitigation
2.x users should upgrade to 2.25.2, 3.x users should upgrade to 3.4.0
Credit
This issue was discovered by GHSL team member @pwntester (Alvaro Muñoz)
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-15013 and https://issues.apache.org/jira/browse/CAMEL-15050 refers to the various commits that resovoled the issue, and have more details.