CVE-2017-5643

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE...

CVE-2017-5643

The CVE-2017-5643 issue affects Apache Camel’s Validation Component, which is vulnerable to SSRF via remote DTDs and XML External Entities (XXE) in XML streams. The vulnerability arises when the component processes DTDs/XXEs, allowing remote resources to be fetched. Impact details in connected do...

Design/Logic Flaw

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...

CVE-2017-3159

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...

CVE-2017-3159

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...

CVE-2017-3159

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...

CVE-2017-3159

CVE-2017-3159 affects Apache Camel's camel-snakeyaml component, enabling Java deserialization that can lead to remote code execution when untrusted data is deserialized. The NVD entry assigns a high/critical impact (CVSS v3 base 9.8, NETWORK/LOW complexity, no authentication) with potential execu...

Apache Camel Remote Code Execution Vulnerability (CNVD-2017-02452)

Apache Camel is an open source project under the Apache Foundation , it is a rule-based routing and mediation engine that provides an enterprise integration model of the implementation of Java objects , through the application program interface or known as declarative Java domain-specific languag...

Remote Code Execution (RCE)

Apache Camel's camel-snakeyaml component is vulnerable to remote code execution through a Java object deserialization vulnerability. It is possible to deserialize untrusted data in an unmarshalling operation that leads to remote code execution...

Remote Code Execution (RCE)

Apache Camel is vulnerable to remote code execution RCE through Java object deserialization. The camel-jackson and camel-jacksonxml components allow to specify a type through the CamelJacksonUnmarshalType property. Deserializing untrusted data can lead to security flaws as demonstrated in various...

CVE-2017-3159

It was found that the camel-snakeyaml component is exploitable for code execution. An attacker could use this vulnerability to send specially crafted payload to a camel-snakeyaml endpoint and causing a remote code execution attack...

CVE-2016-8749

It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in vario...

camel-xstream: Java object de-serialization vulnerability leads to RCE

It was found that Apache Camel's camel-xstream component was vulnerable to Java object deserialization. This vulnerability permits deserialization of data which could lead to information disclosure, code execution, or other possible attacks...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse 6.3 security update

Red Hat JBoss Fuse 6.3, which fixes multiple security issues and includes several bug fixes and enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

Camel: Java object deserialisation in Jetty/Servlet

It was found that Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability. If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatically de-serialize HTTP requests that uses the content-header:...

Apache Camel: source code security analysis report

Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Camel' software: Using Synchronization Primitives in EJB components Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources Violating the Java Object Model Using...

CVE-2015-5348

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

Cross site request forgery (csrf)

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

CVE-2015-5348

CVE-2015-5348 affects Apache Camel: deserialization of HTTP requests using content-header: application/x-java-serialized-object via camel-jetty or camel-servlet, allowing remote code execution. Affected: Camel 2.6.x–2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1. Root cause: insecure Java...

CVE-2015-5348

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...