Description
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Camel
2.17.0 to 2.17.4affected2.18.0 to 2.18.1affectedThe unsupported Camel 2.x (2.14 and earlier) versions may be also affected.affected
References
- https://access.redhat.com/errata/RHSA-2017:0868 ↗
- https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true ↗
- http://www.securityfocus.com/bid/96321 ↗
- http://www.openwall.com/lists/oss-security/2017/05/22/2 ↗
- http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2 ↗
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E ↗
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E ↗