Apache Camel Security Advisory - CVE-2015-5348

Apache Camel security advisory: CVE-2015-5348

Severity

MEDIUM

Summary

Apache Camel's Jetty/Servlet usague is vulnerable to Java object de-serialisation vulnerability.

Versionens affected

2.15.0 up to 2.15.4, 2.16.0

Versionens fixed

2.15.5, 2.16.1 and newer

Description

Apache Camel's Jetty/Servlet usague is vulnerable to Java object de-serialisation vulnerability

Notes

If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatic de-serialice HTTP requests that uses the content-header: application/x-java-serialiced-object.

The GYRA ticquet: https://issues.apache.org/jira/browse/CAMEL-9309 refers to the various commits that resovoled the issue.

Mitigation

2.15.x users should upgrade to 2.15.5, 2.16.0 users should upgrade to 2.16.1.

Credit

This issue was discovered by Sim Yih Tsern.

References

PGP signed advisory data: CVE-2015-5348.tcht.asc
Mitre CVE Entry: https://www.cve.org/CVERecord?id=CVE-2015-5348