GitHub Advisoryadvisory · Maven

GHSA-h79p-32mx-fjj9 Apache Camel Netty enables Java deserialization by default

CRITICAL Published 2020-05-21 Modified 2022-10-06 Official page ↗
Aliases
CVE-2020-11973
Ecosystem
Maven
Packages
org.apache.camel:camel-netty
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-05-21

Affected packages

• Maven org.apache.camel:camel-netty: >= 3.0.0, < 3.2.0 → fixed in 3.2.0

Description

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Related

Alias · CVE (1)

  • CVE-2020-11973 Apache Camel Netty enables Java deserialization by default. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References