Описание
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
A flaw was found in Apache Neethi. When an application explicitly calls the PolicyReference API to retrieve a policy from a remote Uniform Resource Identifier (URI), Apache Neethi does not impose restrictions on the URI. This allows a remote attacker to cause the application to make outbound requests to arbitrary protocols and internal IP addresses. This could lead to information disclosure or enable further network-based attacks.
Меры по смягчению последствий
To mitigate this issue, restrict outbound network access for applications that utilize Apache Neethi's PolicyReference API, especially if they process untrusted input that could influence the URI used for fetching remote policies. Implement firewall rules or network policies to limit the protocols and IP addresses to which the application can connect. This may impact application functionality if legitimate remote policy fetching is required.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | neethi | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | neethi | Fix deferred | ||
| Red Hat Fuse 7 | neethi | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | neethi | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | neethi | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | neethi | Fix deferred | ||
| Red Hat Process Automation 7 | neethi | Fix deferred | ||
| Red Hat Single Sign-On 7 | neethi | Fix deferred | ||
| Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 | neethi | Fixed | RHSA-2026:19835 | 20.05.2026 |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
5.3 Medium
CVSS3