Description
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/05/14/9
https://camel.apache.org/security/CVE-2020-11973.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
Related Vulnerabilities
CVE-2021-36374 Vulnerability in maven package org.apache.ant:ant
CVE-2023-34434 Vulnerability in maven package org.apache.inlong:manager-pojo
CVE-2019-0233 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2021-21626 Vulnerability in maven package io.jenkins.plugins:warnings-ng
CVE-2019-9518 Vulnerability in maven package io.netty:netty-codec-http2