CVEvulnerability
CVE-2020-11973
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-05-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Affected configurations
• apache camel (>= 2.22.0 <= 2.25.0)
• apache camel (>= 3.0.0 <= 3.1.0)
• oracle communications diameter signaling router (>= 8.0.0 <= 8.5.0)
• oracle enterprise manager base platform 13.3.0.0
• oracle enterprise manager base platform 13.4.0.0
• oracle flexcube private banking 12.0.0
• oracle flexcube private banking 12.1.0
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://www.openwall.com/lists/oss-security/2020/05/14/9 Mailing List, Third Party Advisory
- https://camel.apache.org/security/CVE-2020-11973.html Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/05/14/9 Mailing List, Third Party Advisory
- https://camel.apache.org/security/CVE-2020-11973.html Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory