GitHub Advisoryadvisory · Maven

GHSA-2x6r-7427-95cm Deserialization of Untrusted Data in Apache Camel RabbitMQ

HIGH Published 2021-05-21 Modified 2021-05-21 Official page ↗
Aliases
CVE-2020-11972
Ecosystem
Maven
Packages
org.apache.camel:camel-rabbitmq
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-05-21

Affected packages

• Maven org.apache.camel:camel-rabbitmq: < 2.25.1 → fixed in 2.25.1 • Maven org.apache.camel:camel-rabbitmq: >= 3.0.0, < 3.2.0 → fixed in 3.2.0

Description

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Related

Alias · CVE (1)

  • CVE-2020-11972 Apache Camel RabbitMQ enables Java deserialization by default. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References