Apache Camel can allow remote attackers to execute arbitrary commands
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-5348US | high8.1 | — | ||
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attac… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.ascWEB
- http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2016-2035.htmlWEB
- http://www.securityfocus.com/archive/1/537147/100/0/threadedWEB
- http://www.securityfocus.com/bid/80696WEB
- https://github.com/advisories/GHSA-26v6-w6fw-rh94ADVISORY
- https://github.com/apache/camelWEB
- https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99aWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan