CVE-2020-11973

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-11973
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11973.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-11973
Aliases
Published
2020-05-14T17:15:12.193Z
Modified
2026-03-15T14:37:01.314013Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type
GIT
Repo
https://github.com/apache/camel
Events
Introduced
363777cc93ab6072cd12d2a231c2165cbc6c0524
Last affected
fa2a3c885e621014e1d54663b141b9f10b1299a4
Introduced
ac11f88de7594232c3c28532a19377764665ce13
Last affected
9636f69dd42c5b01052875f960fb05d2edc4a8a9
Database specific 
{
    "versions": [
        {
            "introduced": "2.22.0"
        },
        {
            "last_affected": "2.25.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.1.0"
        }
    ]
}

Affected versions

camel-3.*
camel-3.0.0
camel-3.1.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "8.0.0"
            },
            {
                "last_affected": "8.5.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.3.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.4.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.1.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11973.json"