PT-2024-1815 · Apache · Apache Camel

Haoran Zhi + 2 · Published 2024-02-19 · Updated 2026-04-27 · CVE-2024-22369

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Camel versions 3.0.0 through 3.21.3 Apache Camel versions 3.22.0 Apache Camel versions 4.0.0 through 4.0.3 Apache Camel versions 4.1.0 through 4.3.x

Description The issue is related to the deserialization of untrusted data in the Apache Camel SQL Component, which can allow a remote attacker to execute arbitrary code.

Recommendations Upgrade to version 4.4.0 to fix the issue. If on the 4.0.x LTS releases stream, upgrade to 4.0.4. If on 3.x, move to 3.21.4 or 3.22.1.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-01558

CVE-2024-22369

GHSA-36XR-4X2F-CFJ9

Affected Products

Apache Camel

References · 26

• 🔥 https://github.com/oscerd/CVE-2024-22369 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22369 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-02-21.1.pdf · Security Note
• https://lists.apache.org/thread/3dko781dy2gy5l3fs48p56fgp429yb0f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22369 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-36xr-4x2f-cfj9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01558 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/12718 · Note
• https://github.com/apache/camel/pull/12716 · Note
• https://github.com/apache/camel/pull/12717 · Note
• https://github.com/apache/camel/pull/12789 · Note
• https://github.com/apache/camel/pull/12707 · Note
• https://github.com/apache/camel/pull/12719 · Note
• https://github.com/apache/camel/pull/12709 · Note