This advisory covers five security vulnerabilities affecting the Red Hat Build of Apache Camel 4.18 for Quarkus 3.33. Two critical vulnerabilities in jackson-databind allow arbitrary code execution through security bypass and PolymorphicTypeValidator bypass. Two denial of service vulnerabilities in micrometer-core can be triggered by specially crafted gRPC and HTTP requests. Additionally, Apache CXF is vulnerable to information disclosure via out-of-band external entity resolution due to missing JAXP hardening. Red Hat has issued an update (RHBQ 3.33.2.SP2) to address these issues. The advisory does not specify affected versions or CVSS scores but rates the update as important for security and stability.

Successful exploitation of the jackson-databind vulnerabilities could allow attackers to execute arbitrary code. The micrometer-core vulnerabilities could enable denial of service attacks via crafted network requests. The Apache CXF vulnerability could lead to information disclosure through external entity resolution. These issues collectively pose significant risks to affected systems if left unpatched.

Red Hat has released an official update (RHBQ 3.33.2.SP2) that addresses these vulnerabilities. Users should back up their existing installations, including applications and configurations, before applying the update. Applying this update is the recommended remediation to mitigate the described security risks. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.