CVE-2024-22369

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22369
Aliases
Published
2024-02-20T14:58:36.291Z
Modified
2026-07-08T07:31:44.135852335Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
Details

Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.21.4"
                },
                {
                    "introduced": "3.22.0"
                },
                {
                    "fixed": "3.22.1"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.4"
                },
                {
                    "introduced": "4.1.0"
                },
                {
                    "fixed": "4.4.0"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.21.4"
                },
                {
                    "introduced": "3.22.0"
                },
                {
                    "fixed": "3.22.1"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.4"
                },
                {
                    "introduced": "4.1.0"
                },
                {
                    "fixed": "4.4.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22369.json",
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type
GIT
Repo
https://github.com/apache/camel
Events
Introduced
ac11f88de7594232c3c28532a19377764665ce13
Fixed
63dc3d2bbfc14abce85fedee71499a45d746d661
Introduced
8d135894cd73970c82da5da0dc71ecc7f5521ad5
Fixed
344cacf9ea0afec8639e901868202767d2b66ce3
Introduced
363e7e1c93f61e23cdae808f2180908169c78f6e
Fixed
aab0e881d960959cce968804cc269fa38dd1aae5
Introduced
36f52065717df1fb86de0138c1b59a26d204cb5b
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:camel:3.22.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.21.4"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.4"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.4.0"
        },
        {
            "introduced": "3.22.0"
        },
        {
            "last_affected": "3.22.0"
        }
    ]
}

Affected versions

3.*
3.22.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22369.json"