| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.camel:camel-jackson | ≥ 2.17.0, < 2.17.5≥ 2.18.0, < 2.18.2< 2.16.5 | 2.17.52.18.22.16.5 |
| camel | = 2.16.0= 2.16.1= 2.16.2= 2.16.3= 2.16.4= 2.17.0= 2.17.1= 2.17.2= 2.17.3= 2.17.4= 2.18.0= 2.18.1 |
Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.
Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2.
The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free