The Red Hat security advisory RHSA-2024:11023 announces the availability of HawtIO 4.1.0 for the Red Hat build of Apache Camel 4 GA Release, which includes fixes for nine distinct vulnerabilities: CVE-2024-43800 (improper sanitization in serve-static), CVE-2024-43799 (code execution in Send library), CVE-2024-38816 (path traversal in Spring WebMVC), CVE-2024-8184 (remote DoS in Jetty server), CVE-2024-2700 (leak of local configuration properties in quarkus-core), CVE-2024-4068 (character limit failure in braces), CVE-2024-7885 (information leakage in undertow proxy protocol parsing), CVE-2024-45296 (ReDoS in path-to-regexp), and CVE-2024-43796 (improper input handling in Express redirects). The advisory references specific bugzilla entries for each fix and directs users to apply this update after ensuring all previous errata are applied. No CVSS scores are provided, but the overall impact is rated as Important by Red Hat Product Security.

The vulnerabilities fixed in this update affect multiple components used in the Red Hat build of Apache Camel 4, potentially allowing attackers to execute code, perform path traversal, cause denial of service, leak sensitive configuration information, and exploit regular expression backtracking. These issues could compromise application security and stability if left unpatched. The advisory does not report known exploits in the wild at this time.

Red Hat has released HawtIO 4.1.0 for the Red Hat build of Apache Camel 4 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.