N0Mi1K

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT REGEX NAME FINDER.EMAIL and DEFAULT REGEX NAME FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion by a small crafted input. For the EMAIL pattern, a long run of local-part characters that is never followed by an @ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows quadratically with input length: an input of approximately 32 KB consumes several seconds of CPU in a single find() call and returns no match, and each doubling of the input multiplies the cost roughly four-fold. For the URL pattern, the query-string sub-expression nests a capturing repetition inside an outer repetition. The JDK matcher recurses once per query token, so an input of approximately 4 KB containing many &-separated tokens exhausts the thread stack and causes java.lang.StackOverflowError to propagate out of find(), terminating the calling thread. On a thread created with a smaller stack (for example -Xss512k, typical of server worker pools) approximately 1 KB is sufficient. In both cases an attacker who can supply text for analysis can convert a single request into seconds to minutes of pinned CPU, or into an abrupt thread death, denying service to the embedding application. No authentication, special configuration, or model file is required beyond the application having selected one of the two built-in finders. This issue affects Apache OpenNLP: from 2.0.0 through 2.5.11; from 3.0.0-M1 through 3.0.0-M5. Users are recommended to upgrade to version 2.5.12, or to 3.0.0-M6 for users tracking the 3.0.0 milestone line, which fix the issue.

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).  On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter  will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions prior to 8.19.0 Apache Wicket versions prior to 9.24.0 Apache Wicket versions prior to 10.11.0 **Description** Improper validation of resource URL attributes allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style, and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. Because the `IPackageResourceGuard` and `WebApplicationPath` do not inspect the attacker-controlled portion of the path, a crafted request can escape the intended package directory on servlet containers that normalize `..` in `ServletContext.getResource()`. The readable files are limited to extensions permitted by the configured `IPackageResourceGuard`. Applications using the blocklist-based `PackageResourceGuard` or custom patterns may disclose configuration files such as `web.xml`. Additionally, the lookup process can act as an existence oracle for arbitrary paths. **Recommendations** Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 **Description** A relative path traversal issue exists in the `camel-azure-storage-blob` component. The `downloadBlobToFile` operation in the `BlobOperations.downloadBlobToFile()` function allows downloading Azure Storage blobs to the local filesystem using the `fileDir` endpoint option. Because the component joins `fileDir` with the remote blob name without lexical normalization or boundary checks, a blob name containing parent-directory segments can resolve to a location outside the intended directory. This allows an attacker who can influence blob names in a consumed container to create or overwrite files on the local system with the privileges of the Camel process. **Recommendations** Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Upgrade to version 4.22.0. As a temporary mitigation, use the `regex` endpoint option to ensure only simple single-segment names are accepted, filtering out path separators or parent-directory segments. Avoid using the `downloadBlobToFile` operation on untrusted containers and instead use a file name controlled by the route. Treat blob names in externally writable containers as untrusted input and avoid deriving local filesystem paths from them.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x **Description** A relative path traversal issue exists in the `camel-azure-storage-datalake` component during the `downloadToFile` operation. The component writes files to a local directory specified by the `fileDir` endpoint option by joining it with the remote path name provided by the Azure SDK without lexical normalization or boundary checks. Because the `DataLakeConsumer.createBatchExchangesFromPath` function creates exchanges from `PathItem.getName()` verbatim, a remote file name containing parent-directory segments can resolve to a location outside the intended `fileDir`. This allows an attacker who can influence file names in the consumed Data Lake filesystem to create or overwrite files on the local filesystem with the privileges of the Camel process, potentially leading to a loss of file integrity or further privilege escalation. **Recommendations** Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.4 for those on the 4.18.x releases stream. Upgrade to version 4.22.0 for all other affected versions. As a temporary mitigation, use the `regex` endpoint option to ensure only simple single-segment names are accepted, filtering out any names with path separators or parent-directory segments. Avoid using the `downloadToFile` operation on untrusted filesystems and instead use a file name controlled by the route. Treat object names in externally writable Data Lake filesystems as untrusted input and avoid deriving local filesystem paths from them.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 **Description** A relative path traversal issue exists in the `camel-google-storage` consumer. When the `downloadFileName` option is used, the consumer downloads objects from Google Cloud Storage to the local filesystem. If the `downloadFileName` value contains no expression token, the system appends the remote object name to the destination path using the `${file:name}` token. Because this token returns the file name verbatim without lexical normalization or boundary checks, an object name containing parent-directory segments (e.g., ../) can resolve to a location outside the intended directory. This allows an attacker who can control object names in the consumed bucket to create or overwrite files on the local filesystem with the privileges of the Camel process. **Recommendations** Upgrade to version 4.22.0. Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Set the `filter` option to a regular expression that only accepts simple single-segment object names to exclude those with path separators. Use an explicit expression for `downloadFileName` based on `${file:onlyname}` instead of the implicit `${file:name}`. Treat object names in externally writable buckets as untrusted input and avoid deriving local filesystem paths from them.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.8.0 through 4.21.x Apache Camel versions 4.14.x through 4.14.8 Apache Camel versions 4.18.x through 4.18.3 **Description** An improper authentication issue exists in the Apache Camel Platform HTTP Main component. When the embedded HTTP server is configured for JWT authentication using `authenticationEnabled` and JWT keystore properties, the `JWTAuthenticationConfigurer.buildJwtOptions()` function may return null if neither `jwtIssuer` nor `jwtAudience` is configured. This causes the system to skip the `JWTAuthOptions.setJWTOptions()` call, resulting in a Vert.x JWTAuth instance that only validates the token signature and expiry. Consequently, the issuer (`iss`) and audience (`aud`) claims are not validated, allowing any unexpired token signed by a trusted key in the keystore to be accepted, regardless of the intended audience or issuer. This affects both the application server and the management server. **Recommendations** For versions 4.8.0 through 4.21.x, upgrade to version 4.22.0. For versions 4.14.x through 4.14.8, upgrade to version 4.14.9 and configure `jwtIssuer`, `jwtAudience`, or both. For versions 4.18.x through 4.18.3, upgrade to version 4.18.4 and configure `jwtIssuer`, `jwtAudience`, or both. Restrict the JWT keystore to the smallest possible trust set, preferably using a signer dedicated to the service. Ensure that any gateway validating issuer and audience in front of the server cannot be bypassed.

**Name of the Vulnerable Software and Affected Versions** Apache HttpComponents Client versions 5.4 through 5.6.3 **Description** An issue exists where the `HostnameVerificationPolicy#BUILTIN` setting is ignored when using the async version of HttpClient. This failure in TLS hostname verification allows an attacker capable of intercepting and modifying traffic between the client and the server to impersonate the server by presenting a valid certificate issued for a different domain. **Recommendations** Upgrade to version 5.6.4 or newer.