PT-2024-3886 · Apache · Apache Camel

Andrea Cosentino + 1 · CVE-2024-23114 · Published 2024-02-19 · Updated 2026-04-27

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Camel versions 3.0.0 through 3.21.3 Apache Camel versions 3.22.0 through 3.22.0 Apache Camel versions 4.0.0 through 4.0.3 Apache Camel versions 4.1.0 through 4.3.x

Description: The issue is related to the deserialization of untrusted data in the Apache Camel CassandraQL Component AggregationRepository, which is vulnerable to unsafe deserialization. Under specific conditions, it is possible to deserialize a malicious payload, potentially allowing a remote attacker to execute arbitrary code.

Recommendations: For Apache Camel versions 3.0.0 through 3.21.3, upgrade to version 3.21.4. For Apache Camel versions 3.22.0, upgrade to version 3.22.1. For Apache Camel versions 4.0.0 through 4.0.3, upgrade to version 4.0.4. For Apache Camel versions 4.1.0 through 4.3.x, upgrade to version 4.4.0.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-04291

CVE-2024-23114

GHSA-M43P-55RF-8C2J

Affected Products

Apache Camel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23114.json · Exploit
• https://bdu.fstec.ru/vul/2024-04291 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-02-21.1.pdf · Security Note
• https://camel.apache.org/security/CVE-2024-23114.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m43p-55rf-8c2j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23114 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23114 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/12790 · Note
• https://github.com/apache/camel/pull/12760 · Note
• https://github.com/apache/camel/pull/12761 · Note
• https://github.com/apache/camel/pull/12762 · Note
• https://github.com/apache/camel/pull/12759 · Note
• https://github.com/Croway/potential-cassandra · Note
• https://issues.apache.org/jira/browse/CAMEL-20306 · Note