Apache Camel can allow remote attackers to execute arbitrary commands
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-5348US | high8.1 | — | ||
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attac… | ||||
02
references
External citations — patches, advisories, analysis.
- http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.ascWEB
- http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2016-2035.htmlWEB
- http://www.securityfocus.com/archive/1/537147/100/0/threadedWEB
- http://www.securityfocus.com/bid/80696WEB
- https://github.com/advisories/GHSA-26v6-w6fw-rh94ADVISORY
- https://github.com/apache/camelWEB
- https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99aWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan