io.quarkus:quarkus-camel-servlet (0.19.1), io.quarkus:quarkus-camel-servlet-deployment (0.19.1) +38 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.19.1)

io.quarkus:quarkus-undertow MAVEN version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-camel-servlet 0.19.1 - io.quarkus:quarkus-camel-servlet-deployment 0.19.1 -...

de.wayofquality.blended:blended-camel-utils (>=1.1.2, <=1.1.4), de.wayofquality.blended:blended-karaf-features (>=1.1.2, <=1.1.4) +47 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (>=2.1.0, <=2.15.4)

org.apache.camel:camel-servlet MAVEN version =2.1.0, =1.1.2, =1.1.2, =0.0.4, =0.0.4, =0.0.3, =0.0.3, =0.0.4, =0.0.3, =0.0.4, =0.0.5 and more Source cves: CVE-2015-5348 Source advisory: GHSA-26V6-W6FW-RH94...

org.apache.camel:camel-atmosphere-websocket (2.16.0), org.apache.camel:camel-example-cxf-tomcat (2.16.0) +8 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (2.16.0)

org.apache.camel:camel-servlet MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-servlet and may be impacted: - org.apache.camel:camel-atmosphere-websocket 2.16.0 - org.apache.camel:camel-example-cxf-tomcat...

org.apache.camel:camel-atmosphere-websocket (2.16.0), org.apache.camel:camel-example-cxf-tomcat (2.16.0) +8 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (2.16.0)

org.apache.camel:camel-servlet MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-servlet and may be impacted: - org.apache.camel:camel-atmosphere-websocket 2.16.0 - org.apache.camel:camel-example-cxf-tomcat...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

Camel: Java object deserialisation in Jetty/Servlet

It was found that Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability. If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatically de-serialize HTTP requests that uses the content-header:...

CVE-2015-5348

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

PT-2016-3685

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.6.x through 2.14.x Apache Camel versions 2.15.x before 2.15.5 Apache Camel versions 2.16.x before 2.16.1 Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object i...

CVE-2015-5348: Undefined Security Weakness

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

Apache Camel Java Object Deserialization Vulnerability

Apache Camel is based on the known enterprise-class integration model on the open source integration framework . Camel router , if camel-jetty or camel-servlet used as a consumer , Camel will automatically deserialize HTTP requests using content-header: application/x-java-serialized-object , remo...