This advisory covers the release of HawtIO 4.1.0 for the Red Hat build of Apache Camel 4 GA Release, which fixes nine distinct vulnerabilities: CVE-2024-43800 (improper sanitization in serve-static), CVE-2024-43799 (code execution in send library), CVE-2024-38816 (path traversal in Spring WebMVC), CVE-2024-8184 (remote DoS in Jetty server), CVE-2024-2700 (leak of local configuration properties in Quarkus core), CVE-2024-4068 (braces component failing to limit characters), CVE-2024-7885 (information leakage in undertow proxy protocol parsing), CVE-2024-45296 (ReDoS in path-to-regexp), and CVE-2024-43796 (improper input handling in express redirects). These vulnerabilities affect the Red Hat build of Apache Camel versions >=4.0.0 and <4.1.0. The advisory references multiple bugzilla entries and provides a link to Red Hat's update instructions.

The vulnerabilities collectively pose risks including potential code execution, information leakage, path traversal, denial of service, and regular expression denial of service attacks. These could impact the security and stability of applications using the affected components within the Red Hat build of Apache Camel 4 prior to version 4.1.0. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released HawtIO 4.1.0 for the Red Hat build of Apache Camel 4 which addresses these vulnerabilities. Users should apply this update to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.