[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CVE-2015-5348 - Apache Camel medium disclosure vulnerability
- To: dev <dev@xxxxxxxxxxxxxxxx>, "users@xxxxxxxxxxxxxxxx" <users@xxxxxxxxxxxxxxxx>, oss-security@xxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx, security <security@xxxxxxxxxx>
- Subject: CVE-2015-5348 - Apache Camel medium disclosure vulnerability
- From: Claus Ibsen <claus.ibsen@xxxxxxxxx>
- Date: Thu, 17 Dec 2015 10:27:59 +0100
Apache Camel's Jetty/Servlet usage is vulnerable to Java object
de-serialisation vulnerability
If using camel-jetty, or camel-servlet as a consumer in Camel routes,
then Camel will automatic de-serialize HTTP requests that uses the
content-header: application/x-java-serialized-object.
Please study this security vulnerability carefully!
CVE-2015-5348 - [1]
You can download the fixed Apache Camel 2.15.x and 2.16.x version from the
Apache mirrors [2] or from the Central Maven repository.
[1]
http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc?version=1&modificationDate=1450340845000&api=v2
[2] http://camel.apache.org/download
On behalf of the Camel PMC,
Claus Ibsen
--
Claus Ibsen
-----------------
http://davsclaus.com @davsclaus
Camel in Action 2: https://www.manning.com/ibsen2