Deserialization Of Untrusted Data

Apache Camel PQC Component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to AwsSecretsManagerKeyLifecycleManager.deserializeMetadata deserializing attacker-controlled data with ObjectInputStream.readObject without an ObjectInputFilter or class allow-list, allowing a...