Most recent entries from all

cnvd-2017-04605

EUVD-2026-87404

fkie_cve-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

GHSA-vvjc-q5vr-52q6 — Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks

Affected: Maven: org.apache.camel:camel-jackson

Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.

Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2.

The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.

gsd-2016-8749

RHSA-2017:1832 — Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

bouncycastle: Information disclosure in GCMBlockCipher camel-jacksonxml: Unmarshalling operation are vulnerable to RCE Security: Improper handling of path parameters allows bypassing the security constraint hawtio: Proxy is sharing cookies among all the clients hawtio: information Disclosure flaws due to unsafe path traversal cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens logback: Serialization vulnerability in SocketServer and ServerSocketReceiver XStream: DoS when unmarshalling void type