Description
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Camel
2.16.0 to 2.16.4affected2.17.0 to 2.17.4affected2.18.0 to 2.18.1affectedThe unsupported Camel 2.x (2.14 and earlier) versions may be also affected.affected
References
- https://access.redhat.com/errata/RHSA-2017:1832 ↗
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true ↗
- http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2 ↗
- http://www.securityfocus.com/bid/97179 ↗
- http://www.openwall.com/lists/oss-security/2017/05/22/2 ↗
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E ↗
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E ↗