Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks
Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues. Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2. The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-8749US | critical9.8 | — | ||
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2WEB
- http://www.openwall.com/lists/oss-security/2017/05/22/2WEB
- http://www.securityfocus.com/bid/97179WEB
- https://access.redhat.com/errata/RHSA-2017:1832WEB
- https://github.com/advisories/GHSA-vvjc-q5vr-52q6ADVISORY
- https://github.com/apache/camelPACKAGE
- https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7eWEB
- https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan