PT-2017-9780 · Apache · Apache Camel

Moritz Bechler · Publicado 2017-03-28 · Atualizado 2019-05-24 · CVE-2016-8749

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.16.5 Apache Camel versions prior to 2.17.5 Apache Camel versions prior to 2.18.2

Description The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshalling operations, which can lead to Remote Code Execution attacks. De-serializing untrusted data can result in security flaws, as seen in similar Java de-serialization issues.

Recommendations For versions prior to 2.16.5, upgrade to 2.16.5. For versions prior to 2.17.5, upgrade to 2.17.5. For versions prior to 2.18.2, upgrade to 2.18.2. As a temporary workaround, consider restricting the use of the CamelJacksonUnmarshalType property to minimize the risk of exploitation.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2016-8749

GHSA-VVJC-Q5VR-52Q6

Produtos afetados

Apache Camel

Referências · 28

• 🔥 https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true · Exploit
• https://github.com/apache/camel · Nota
• https://github.com/apache/camel/commit/8c862aa11e31d0f804c4a4516a0715e05e3eebcf · Nota
• https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326 · Nota
• https://github.com/apache/camel/commit/7567488f844f01d72840f7ab6ca18114a11f20d8 · Nota
• https://github.com/apache/camel/commit/881e5099f94316d4a66ffbff0a3e6915829d49d7 · Nota
• https://github.com/apache/camel/commit/abb45b2c2ada2bbb34138230540b37d259c1e98d · Nota
• https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7e · Nota
• https://github.com/apache/camel/commit/2b0e96117d6f01eba0c18e2ff8df6a438e819721 · Nota
• https://github.com/apache/camel/commit/d4102512147eca2af21c3b6ed63a67d852f4e66a · Nota
• https://github.com/apache/camel/commit/83fef7108456eeac1506853d194cd1360851c4fe · Nota
• https://github.com/apache/camel/commit/ccf149c76bf37adc5977dc626e141a14e60b5aee · Nota
• https://github.com/apache/camel/commit/57d01e2fc8923263df896e9810329ee5b7f9b69e · Nota
• https://github.com/apache/camel/commit/5ae9c0dcc4843347cd01ffb58ce5dd0687755a14 · Nota
• https://access.redhat.com/errata/RHSA-2017:1832 · Aviso do Fabricante