| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.apache.camel:camel-jackson | ≥ 2.17.0, < 2.17.5≥ 2.18.0, < 2.18.2< 2.16.5 | 2.17.52.18.22.16.5 |
| camel | = 2.16.0= 2.16.1= 2.16.2= 2.16.3= 2.16.4= 2.17.0= 2.17.1= 2.17.2= 2.17.3= 2.17.4= 2.18.0= 2.18.1 |
Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.
Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2.
The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí