GHSA-26v6-w6fw-rh94
Suggest an improvement- Source
- https://github.com/advisories/GHSA-26v6-w6fw-rh94
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-26v6-w6fw-rh94/GHSA-26v6-w6fw-rh94.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-26v6-w6fw-rh94
- Aliases
-
- CVE-2015-5348
- Published
- 2018-10-16T23:12:20Z
- Modified
- 2024-12-06T05:25:02.385852Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Apache Camel can allow remote attackers to execute arbitrary commands
- Details
-
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
- Database specific
{ "nvd_published_at": null, "github_reviewed_at": "2020-06-16T20:51:34Z", "cwe_ids": [], "severity": "HIGH", "github_reviewed": true }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2015-5348
- https://github.com/apache/camel/commit/f7f0b18f6924fe0b01f32a25ed1e38e29b1bf8e5
- https://github.com/apache/camel/commit/e7fd5f049c2fd51a528f8062da91a1c75e33b0e8
- https://github.com/apache/camel/commit/d853853469292cd54fd9662c3605030ab5a9566b
- https://github.com/apache/camel/commit/c558f30a6d3820faa3d8c4ad5e54448914ec60d0
- https://github.com/apache/camel/commit/c47cffcadabca0c588753555a386942184a33627
- https://github.com/apache/camel/commit/a68434c258cdcd30587ae7adc5dabbac43eadbbf
- https://github.com/apache/camel/commit/9cbd5867fe73ef07ecba6f16d64689632e3f2a16
- https://github.com/apache/camel/commit/94330f99acb6f28155793b253de9956c3798f3bb
- https://github.com/apache/camel/commit/92081b203523c5ed502ed41df43cbd8655caf9b9
- https://github.com/apache/camel/commit/7e28d0af471ea992eb74807a4abd1626b88d678a
- https://github.com/apache/camel/commit/735ee02c693964b5f700af13a2adfeae56b848a4
- https://github.com/apache/camel/commit/5ea0a6f6c6a54f1cddf9691a99b0c237afc95348
- https://github.com/apache/camel/commit/515c822148d52de9e7cdf4f6b01f7b793f2f273f
- https://github.com/apache/camel/commit/4f065fe07c1dcd7b451e6005a6dc8e96d77da43e
- https://github.com/apache/camel/commit/44e6a3036e5a11d90b60c142cf51ed74b792de31
- https://github.com/apache/camel/commit/349109b0834764560f0be69eb74f43a16bd220b0
- https://github.com/apache/camel/commit/32eacdaff16f8709da55e27b83fa21a16d739f63
- https://github.com/apache/camel/commit/1b1ccbcd94860f6f1d8caf98fb59e6ab7b3940b4
- https://github.com/apache/camel/commit/190d7c81b7e3ce767514e319630b1bbaf27e6817
- https://github.com/apache/camel/commit/13e43c1412ad72d99030b4eb4cb72c84fa57d5ff
- https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99a
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-9309
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
- https://github.com/advisories/GHSA-26v6-w6fw-rh94
- http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc
- http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
- http://www.securityfocus.com/archive/1/537147/100/0/threaded
- http://www.securityfocus.com/bid/80696
Affected packages
Maven
org.apache.camel:camel-jetty
Package
- Name
- org.apache.camel:camel-jetty
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-jetty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
1.*
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
2.*
2.0-M1
2.0-M2
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
org.apache.camel:camel-jetty
Package
- Name
- org.apache.camel:camel-jetty
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-jetty
org.apache.camel:camel-servlet
Package
- Name
- org.apache.camel:camel-servlet
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-servlet
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
org.apache.camel:camel-servlet
Package
- Name
- org.apache.camel:camel-servlet
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-servlet
org.apache.camel:camel-http
Package
- Name
- org.apache.camel:camel-http
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
2.*
2.0-M1
2.0-M2
2.0-M3
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
org.apache.camel:camel-http
Package
- Name
- org.apache.camel:camel-http
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http
org.apache.camel:camel-http-common
Package
- Name
- org.apache.camel:camel-http-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http-common
org.apache.camel:camel-http-common
Package
- Name
- org.apache.camel:camel-http-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http-common
org.apache.camel:camel-http4
Package
- Name
- org.apache.camel:camel-http4
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http4
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
org.apache.camel:camel-http4
Package
- Name
- org.apache.camel:camel-http4
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-http4
org.apache.camel:camel-ahc
Package
- Name
- org.apache.camel:camel-ahc
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-ahc
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.5
Affected versions
2.*
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0-RC1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
org.apache.camel:camel-ahc
Package
- Name
- org.apache.camel:camel-ahc
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.camel/camel-ahc