CVSS: 9.8EPSS: 9%CPEs: 12EXPL: 1CVE-2016-8749 – camel-jacksonxml: Unmarshalling operation are vulnerable to RCE
https://notcve.org/view.php?id=CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. Apache Camel's Jackson y JacksonXML operación unmarshalling son vulnerables a ataques de ejecución remota de código. It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues. • http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2 http://www.openwall.com/lists/oss-security/2017/05/22/2 http://www.securityfocus.com/bid/97179 https://access.redhat.com/errata/RHSA-2017:1832 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://www.gi • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.4EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5643 – camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE
https://notcve.org/view.php?id=CVE-2017-5643
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. Apache Camel's Validation Component es vulnerable contra ataques de SSRF a través de DTDs y XXE remotos. It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources. • http://camel.apache.org/security-advisories.data/CVE-2017-5643.txt.asc?version=1&modificationDate=1489652454000&api=v2 http://www.securityfocus.com/bid/97226 https://access.redhat.com/errata/RHSA-2017:1832 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://access.redhat.com/security/cve/CVE-2017-5643 https://bugzilla.redhat. • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-3159 – camel-snakeyaml: Unmarshalling operation is vulnerable to RCE
https://notcve.org/view.php?id=CVE-2017-3159
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. El componente camel-snakeyaml de Apache Camel es vulnerable a la vulnerabilidad de la deserialización de objetos Java. La deserialización de datos no confiables puede conducir a a fallos de seguridad. It was found that the camel-snakeyaml component is exploitable for code execution. • http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2 http://www.openwall.com/lists/oss-security/2017/05/22/2 http://www.securityfocus.com/bid/96321 https://access.redhat.com/errata/RHSA-2017:0868 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://www.gi • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2015-5344 – camel-xstream: Java object de-serialization vulnerability leads to RCE
https://notcve.org/view.php?id=CVE-2015-5344
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request. El componente camel-xstream en Apache Camel en versiones anteriores a 2.15.5 y 2.16.x en versiones anteriores a 2.16.1 permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado en una petición HTTP. It was found that Apache Camel's camel-xstream component was vulnerable to Java object deserialization. This vulnerability permits deserialization of data which could lead to information disclosure, code execution, or other possible attacks. • http://camel.apache.org/security-advisories.data/CVE-2015-5344.txt.asc http://rhn.redhat.com/errata/RHSA-2016-2035.html http://www.securityfocus.com/archive/1/537414/100/0/threaded http://www.securityfocus.com/bid/82260 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://access.redhat.com/security/cve/CVE-2015-5344& • CWE-19: Data Processing Errors CWE-502: Deserialization of Untrusted Data •
CVSS: 8.1EPSS: 0%CPEs: 58EXPL: 0CVE-2015-5348 – Camel: Java object deserialisation in Jetty/Servlet
https://notcve.org/view.php?id=CVE-2015-5348
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request. Apache Camel 2.6.x hasta la versión 2.14.x, 2.15.x en versiones anteriores a 2.15.5 y 2.16.x en versiones anteriores a 2.16.1, cuando se utiliza(1) camel-jetty o (2) camel-servlet como un consumidor en rutas Camel, permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado en una petición HTTP. It was found that Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability. If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatically de-serialize HTTP requests that uses the content-header: application/x-java-serialized-object. • http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html http://rhn.redhat.com/errata/RHSA-2016-2035.html http://www.securityfocus.com/archive/1/537147/100/0/threaded http://www.securityfocus.com/bid/80696 https://issues.apache.org/jira/browse/CAMEL-9309 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org&# • CWE-19: Data Processing Errors •