Description
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.camel:camel-xstream | < 2.15.5 | 2.15.5 | GHSA-gv5f-cjw9-5vxg |
| Maven | org.apache.camel:camel-xstream | >= 2.16.0, < 2.16.1 | 2.16.1 | GHSA-gv5f-cjw9-5vxg |
Advisories 1
- WID-SEC-2024-3616 Red Hat JBoss Fuse: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 5, 2024
References
- RHSA-2016:2035 vendor-advisory
- http://camel.apache.org/security-advisories.data/CVE-2015-5344.txt.asc
- 82260 vdb-entry
- 20160130 CVE-2015-5344 - Apache Camel medium disclosure vulnerability mailing-list
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html mailing-list
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html mailing-list