Skip to content
OpenAdvisories
High · 8.1 CVE-2015-5348 EUVD-2018-0474GHSA-26v6-w6fw-rh94

Apache Camel can allow remote attackers to execute arbitrary commands

Published Apr 15, 2016 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.apache.camel:camel-ahc Package: org.apache.camel:camel-http Package: org.apache.camel:camel-http-common Package: org.apache.camel:camel-http4 Package: org.apache.camel:camel-jetty Package: org.apache.camel:camel-servlet Ecosystem: Maven

Description

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.camel:camel-ahc < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-ahc >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http-common < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http-common >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http4 < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-http4 >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-jetty < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-jetty >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-servlet < 2.15.5 2.15.5 GHSA-26v6-w6fw-rh94
Maven org.apache.camel:camel-servlet >= 2.16.0, < 2.16.1 2.16.1 GHSA-26v6-w6fw-rh94

Advisories 1

References