Insecure Deserialization

🗓️ 15 May 2020 05:27:21Reported by Veracode Vulnerability DatabaseType

camel-netty insecure deserialization vulnerabilit

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Camel's JMX, Apache Camel RabbitMQ and Apache Camel Netty affects IBM Operations Analytics Predictive Insights (CVE-2020-11971, CVE-2020-11972, CVE-2020-11973)	11 Aug 202014:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in Apache Camel shipped with IBM Netcool/OMNIbus Probe DSL Factory Framework	16 Jul 202005:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable to Apache Camel Core vulnerabilities	15 Jun 202006:00	–	ibm
IBM Security Bulletins	Security Bulletin:IBM Resilient SOAR is Using Components with Known Vulnerabilities - Apache Camel ( CVE-2019-0188, CVE-2020-11972, CVE-2020-11973)	1 Oct 202012:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
CNVD	Apache Camel Netty Code Issue Vulnerability	15 May 202000:00	–	cnvd
CVE	CVE-2020-11973	14 May 202016:22	–	cve
Cvelist	CVE-2020-11973	14 May 202016:22	–	cvelist
EUVD	EUVD-2020-0425	7 Oct 202500:30	–	euvd
Github Security Blog	Apache Camel Netty enables Java deserialization by default	21 May 202021:09	–	github

Vulners

Node

apache camel-nettyRange2.14.0–2.25.0java

apache camel-nettyRange3.0.0-RC1–3.0.1java

Source	Link
github	www.github.com/apache/camel/pull/3537
openwall	www.openwall.com/lists/oss-security/2020/05/14/9
github	www.github.com/coheigea
oracle	www.oracle.com/security-alerts/cpuApr2021.html
oracle	www.oracle.com/security-alerts/cpujan2021.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
oracle	www.oracle.com//security-alerts/cpujul2021.html
camel	www.camel.apache.org/security/CVE-2020-11973.html

05 Oct 2022 23:31Current

3.4Low risk

Vulners AI Score3.4

CVSS 27.5

CVSS 3.19.8

EPSS0.14103