PT-2016-3685 · Apache · Apache Camel

Sim Yih Tsern · Published 2016-04-15 · Updated 2019-05-24 · CVE-2015-5348

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.6.x through 2.14.x Apache Camel versions 2.15.x before 2.15.5 Apache Camel versions 2.16.x before 2.16.1

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request when using camel-jetty or camel-servlet as a consumer in Camel routes.

Recommendations For Apache Camel versions 2.6.x through 2.14.x, update to a version outside of this range to resolve the issue. For Apache Camel versions 2.15.x before 2.15.5, update to version 2.15.5 or later. For Apache Camel versions 2.16.x before 2.16.1, update to version 2.16.1 or later.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2015-5348

GHSA-26V6-W6FW-RH94

Affected Products

Apache Camel

References · 35

• http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5348 · Security Note
• https://issues.apache.org/jira/browse/CAMEL-9309 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2035.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26v6-w6fw-rh94 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/a68434c258cdcd30587ae7adc5dabbac43eadbbf · Note
• https://github.com/apache/camel/commit/32eacdaff16f8709da55e27b83fa21a16d739f63 · Note
• https://github.com/apache/camel/commit/190d7c81b7e3ce767514e319630b1bbaf27e6817 · Note
• https://github.com/apache/camel/commit/c47cffcadabca0c588753555a386942184a33627 · Note
• https://github.com/apache/camel/commit/c558f30a6d3820faa3d8c4ad5e54448914ec60d0 · Note
• https://github.com/apache/camel/commit/13e43c1412ad72d99030b4eb4cb72c84fa57d5ff · Note
• https://github.com/apache/camel/commit/349109b0834764560f0be69eb74f43a16bd220b0 · Note
• https://github.com/apache/camel/commit/4f065fe07c1dcd7b451e6005a6dc8e96d77da43e · Note
• https://github.com/apache/camel/commit/515c822148d52de9e7cdf4f6b01f7b793f2f273f · Note