GHSA-26v6-w6fw-rh94
Suggest an improvement- Source
- https://github.com/advisories/GHSA-26v6-w6fw-rh94
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-26v6-w6fw-rh94/GHSA-26v6-w6fw-rh94.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-26v6-w6fw-rh94
- Aliases
-
- CVE-2015-5348
- Published
- 2018-10-16T23:12:20Z
- Modified
- 2024-12-06T05:25:02.385852Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Apache Camel can allow remote attackers to execute arbitrary commands
- Details
-
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:51:34Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2015-5348
- https://github.com/apache/camel/commit/f7f0b18f6924fe0b01f32a25ed1e38e29b1bf8e5
- https://github.com/apache/camel/commit/e7fd5f049c2fd51a528f8062da91a1c75e33b0e8
- https://github.com/apache/camel/commit/d853853469292cd54fd9662c3605030ab5a9566b
- https://github.com/apache/camel/commit/c558f30a6d3820faa3d8c4ad5e54448914ec60d0
- https://github.com/apache/camel/commit/c47cffcadabca0c588753555a386942184a33627
- https://github.com/apache/camel/commit/a68434c258cdcd30587ae7adc5dabbac43eadbbf
- https://github.com/apache/camel/commit/9cbd5867fe73ef07ecba6f16d64689632e3f2a16
- https://github.com/apache/camel/commit/94330f99acb6f28155793b253de9956c3798f3bb
- https://github.com/apache/camel/commit/92081b203523c5ed502ed41df43cbd8655caf9b9
- https://github.com/apache/camel/commit/7e28d0af471ea992eb74807a4abd1626b88d678a
- https://github.com/apache/camel/commit/735ee02c693964b5f700af13a2adfeae56b848a4
- https://github.com/apache/camel/commit/5ea0a6f6c6a54f1cddf9691a99b0c237afc95348
- https://github.com/apache/camel/commit/515c822148d52de9e7cdf4f6b01f7b793f2f273f
- https://github.com/apache/camel/commit/4f065fe07c1dcd7b451e6005a6dc8e96d77da43e
- https://github.com/apache/camel/commit/44e6a3036e5a11d90b60c142cf51ed74b792de31
- https://github.com/apache/camel/commit/349109b0834764560f0be69eb74f43a16bd220b0
- https://github.com/apache/camel/commit/32eacdaff16f8709da55e27b83fa21a16d739f63
- https://github.com/apache/camel/commit/1b1ccbcd94860f6f1d8caf98fb59e6ab7b3940b4
- https://github.com/apache/camel/commit/190d7c81b7e3ce767514e319630b1bbaf27e6817
- https://github.com/apache/camel/commit/13e43c1412ad72d99030b4eb4cb72c84fa57d5ff
- https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99a
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-9309
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
- https://github.com/advisories/GHSA-26v6-w6fw-rh94
- http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc
- http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
- http://www.securityfocus.com/archive/1/537147/100/0/threaded
- http://www.securityfocus.com/bid/80696
Affected packages
Maven / org.apache.camel:camel-jetty
Package
- Name
- org.apache.camel:camel-jetty
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-jetty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
1.*
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
2.*
2.0-M1
2.0-M2
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
Maven / org.apache.camel:camel-jetty
Package
- Name
- org.apache.camel:camel-jetty
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-jetty
Maven / org.apache.camel:camel-servlet
Package
- Name
- org.apache.camel:camel-servlet
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-servlet
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
Maven / org.apache.camel:camel-servlet
Package
- Name
- org.apache.camel:camel-servlet
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-servlet
Maven / org.apache.camel:camel-http
Package
- Name
- org.apache.camel:camel-http
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
2.*
2.0-M1
2.0-M2
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
Maven / org.apache.camel:camel-http
Package
- Name
- org.apache.camel:camel-http
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http
Maven / org.apache.camel:camel-http-common
Package
- Name
- org.apache.camel:camel-http-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http-common
Maven / org.apache.camel:camel-http-common
Package
- Name
- org.apache.camel:camel-http-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http-common
Maven / org.apache.camel:camel-http4
Package
- Name
- org.apache.camel:camel-http4
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http4
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
Maven / org.apache.camel:camel-http4
Package
- Name
- org.apache.camel:camel-http4
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http4
Maven / org.apache.camel:camel-ahc
Package
- Name
- org.apache.camel:camel-ahc
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-ahc
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
Maven / org.apache.camel:camel-ahc
Package
- Name
- org.apache.camel:camel-ahc
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-ahc