GHSA-vvjc-q5vr-52q6

Source

https://github.com/advisories/GHSA-vvjc-q5vr-52q6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-vvjc-q5vr-52q6/GHSA-vvjc-q5vr-52q6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vvjc-q5vr-52q6

Aliases

CVE-2016-8749

Published

2018-10-16T23:13:00Z

Modified

2024-03-09T05:19:57.002259Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks

Details

Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.

Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2.

The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed_at": "2020-06-16T21:58:26Z",
    "github_reviewed": true
}

References

Affected packages

Maven / org.apache.camel:camel-jackson

Package

Name: org.apache.camel:camel-jackson; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-jackson

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.16.5

Affected versions

2.*

2.0-M2

2.0-M3

2.0.0

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.9.0-RC1

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.9.6

2.9.7

2.9.8

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.10.6

2.10.7

2.11.0

2.11.1

2.11.2

2.11.3

2.11.4

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

2.13.0

2.13.1

2.13.2

2.13.3

2.13.4

2.14.0

2.14.1

2.14.2

2.14.3

2.14.4

2.15.0

2.15.1

2.15.2

2.15.3

2.15.4

2.15.5

2.15.6

2.16.0

2.16.1

2.16.2

2.16.3

2.16.4

Maven / org.apache.camel:camel-jackson

Package

Name: org.apache.camel:camel-jackson; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-jackson

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.17.0

Fixed

2.17.5

Affected versions

2.*

2.17.0

2.17.1

2.17.2

2.17.3

2.17.4

Maven / org.apache.camel:camel-jackson

Package

Name: org.apache.camel:camel-jackson; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-jackson

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.18.0

Fixed

2.18.2

Affected versions

2.*

2.18.0

2.18.1