CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12633 – camel-hessian: Apache Camel's Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks
https://notcve.org/view.php?id=CVE-2017-12633
The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. El componente camel-hessian en Apache Camel en versiones 2.x anteriores a la 2.19.4 y las versiones 2.20.x anteriores a la 2.20.1 es vulnerable a una deserialización de objetos Java. La deserialización de datos no fiables puede conducir a fallos de seguridad. It was found that Apache Camel contains a security vulnerability via camel-hessian component. • http://camel.apache.org/security-advisories.data/CVE-2017-12633.txt.asc http://www.securityfocus.com/bid/101874 https://access.redhat.com/errata/RHSA-2018:0319 https://issues.apache.org/jira/browse/CAMEL-11923 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://access.redhat.com/security/cve/CVE-2017-12633 https:/ • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12634 – camel-castor: Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks
https://notcve.org/view.php?id=CVE-2017-12634
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. El componente camel-castor en Apache Camel en versiones 2.x anteriores a la 2.19.4 y las versiones 2.20.x anteriores a la 2.20.1 es vulnerable a una deserialización de objetos Java. La deserialización de datos no fiables puede conducir a fallos de seguridad. It was found that Apache Camel contains a security vulnerability via camel-castor component. • http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc http://www.securityfocus.com/bid/101876 https://access.redhat.com/errata/RHSA-2018:0319 https://issues.apache.org/jira/browse/CAMEL-11929 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://access.redhat.com/security/cve/CVE-2017-12634 https:/ • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 9%CPEs: 12EXPL: 1CVE-2016-8749 – camel-jacksonxml: Unmarshalling operation are vulnerable to RCE
https://notcve.org/view.php?id=CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. Apache Camel's Jackson y JacksonXML operación unmarshalling son vulnerables a ataques de ejecución remota de código. It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues. • http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2 http://www.openwall.com/lists/oss-security/2017/05/22/2 http://www.securityfocus.com/bid/97179 https://access.redhat.com/errata/RHSA-2017:1832 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://www.gi • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.4EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5643 – camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE
https://notcve.org/view.php?id=CVE-2017-5643
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. Apache Camel's Validation Component es vulnerable contra ataques de SSRF a través de DTDs y XXE remotos. It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources. • http://camel.apache.org/security-advisories.data/CVE-2017-5643.txt.asc?version=1&modificationDate=1489652454000&api=v2 http://www.securityfocus.com/bid/97226 https://access.redhat.com/errata/RHSA-2017:1832 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://access.redhat.com/security/cve/CVE-2017-5643 https://bugzilla.redhat. • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-3159 – camel-snakeyaml: Unmarshalling operation is vulnerable to RCE
https://notcve.org/view.php?id=CVE-2017-3159
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. El componente camel-snakeyaml de Apache Camel es vulnerable a la vulnerabilidad de la deserialización de objetos Java. La deserialización de datos no confiables puede conducir a a fallos de seguridad. It was found that the camel-snakeyaml component is exploitable for code execution. • http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2 http://www.openwall.com/lists/oss-security/2017/05/22/2 http://www.securityfocus.com/bid/96321 https://access.redhat.com/errata/RHSA-2017:0868 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://www.gi • CWE-502: Deserialization of Untrusted Data •