QwikSec

Security Database

CVE

CWE

Training

CVE-2017-3159

Published: Mar 7, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

Vendor	Product	Versions
Apache Software Foundation	Apache Camel	affected `2.17.0 to 2.17.4` affected `2.18.0 to 2.18.1` affected `The unsupported Camel 2.x (2.14 and earlier) versions may be also affected.`

References

vendor-advisory

x_refsource_REDHAT

https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

x_refsource_MISC

vdb-entry

x_refsource_BID

[oss-security] 20170522 Code Execution through a variety Java (Un-)Marshallers

mailing-list

x_refsource_MLIST

http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2

x_refsource_CONFIRM

[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html

mailing-list

x_refsource_MLIST

[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.