Apache Camel can allow remote attackers to execute arbitrary commands
High severity
GitHub Reviewed
Published
Oct 16, 2018
to the GitHub Advisory Database
•
Updated Dec 19, 2023
Package
Affected versions
< 2.15.5
= 2.16.0
Patched versions
2.15.5
2.16.1
Description
Published to the GitHub Advisory Database
Oct 16, 2018
Reviewed
Jun 16, 2020
Last updated
Dec 19, 2023
Credits
-
sunSUNQ Analyst
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
References