Description
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/05/14/9
https://camel.apache.org/security/CVE-2020-11973.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
Related Vulnerabilities
CVE-2019-6284 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2020-36649 Vulnerability in maven package org.webjars.npm:papaparse
CVE-2020-14340 Vulnerability in maven package org.jboss.xnio:xnio-nio
CVE-2021-23566 Vulnerability in npm package nanoid
CVE-2019-10389 Vulnerability in maven package org.jenkins-ci.plugins:relution-publisher