PT-2017-9780 · Apache · Apache Camel

Moritz Bechler · Published 2017-03-28 · Updated 2019-05-24 · CVE-2016-8749

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.16.5 Apache Camel versions prior to 2.17.5 Apache Camel versions prior to 2.18.2

Description The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshalling operations, which can lead to Remote Code Execution attacks. De-serializing untrusted data can result in security flaws, as seen in similar Java de-serialization issues.

Recommendations For versions prior to 2.16.5, upgrade to 2.16.5. For versions prior to 2.17.5, upgrade to 2.17.5. For versions prior to 2.18.2, upgrade to 2.18.2. As a temporary workaround, consider restricting the use of the CamelJacksonUnmarshalType property to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2016-8749

GHSA-VVJC-Q5VR-52Q6

Affected Products

Apache Camel

References · 28

• 🔥 https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true · Exploit
• https://access.redhat.com/errata/RHSA-2017:1832 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvjc-q5vr-52q6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8749 · Security Note
• http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8749 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/8c862aa11e31d0f804c4a4516a0715e05e3eebcf · Note
• https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326 · Note
• https://github.com/apache/camel/commit/7567488f844f01d72840f7ab6ca18114a11f20d8 · Note
• https://github.com/apache/camel/commit/881e5099f94316d4a66ffbff0a3e6915829d49d7 · Note
• https://github.com/apache/camel/commit/abb45b2c2ada2bbb34138230540b37d259c1e98d · Note
• https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7e · Note
• https://github.com/apache/camel/commit/2b0e96117d6f01eba0c18e2ff8df6a438e819721 · Note
• https://github.com/apache/camel/commit/d4102512147eca2af21c3b6ed63a67d852f4e66a · Note