Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation

CRITICAL 9.8CVE-2017-12634 · GHSA-vf4q-8mr7-5c5c · Published 15/11/2017 · updated 17/06/2026

In short

CVE-2017-12634 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.camel:camel-castor, camel (apache).
Chance of exploitation in the next 30 days (EPSS): 7.2%, higher than 94.3% of all vulnerabilities.
Fix: update to 2.19.4, 2.20.1 or later.

Package	Affected versions	Patched versions
org.apache.camel:camel-castor Maven	`≥ 2.0.0, < 2.19.4≥ 2.20.0, < 2.20.1`	`2.19.42.20.1`
camel apache	`= 2.20.0≥ 2.0.0, < 2.19.4`	`2.19.4`

Description

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-12634 · ADVISORY
apache/camel commit 2ae645e · WEB
apache/camel commit 573ebd3 · WEB
apache/camel commit ad3c1ce · WEB
apache/camel commit adc06a7 · WEB
apache/camel commit bdff8f3 · WEB
apache/camel commit c613905 · WEB
access.redhat.com/errata/RHSA-2018:0319 · WEB
GitHub Advisory GHSA-vf4q-8mr7-5c5c · ADVISORY
apache/camel · PACKAGE
issues.apache.org/jira/browse/CAMEL-11929 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.camel:camel-castor

Maven

≥ 2.0.0, < 2.19.4≥ 2.20.0, < 2.20.1

2.19.42.20.1

camel

apache

= 2.20.0≥ 2.0.0, < 2.19.4

2.19.4

Description

NVD description