GHSA-m43p-55rf-8c2j

Suggest an improvement
Source
https://github.com/advisories/GHSA-m43p-55rf-8c2j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m43p-55rf-8c2j
Aliases
  • CVE-2024-23114
Published
2024-02-20T15:31:06Z
Modified
2024-02-22T20:46:19.392159Z
Summary
Deserialization of Untrusted Data in Apache Camel CassandraQL
Details

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

References

Affected packages

Maven / org.apache.camel:camel-cassandraql

Package

Name
org.apache.camel:camel-cassandraql
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-cassandraql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.21.4

Affected versions

3.*

3.0.0
3.0.1
3.1.0
3.2.0
3.3.0
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.5.0
3.6.0
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.8.0
3.9.0
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12.0
3.13.0
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.14.5
3.14.6
3.14.7
3.14.8
3.14.9
3.14.10
3.15.0
3.16.0
3.17.0
3.18.0
3.18.1
3.18.2
3.18.3
3.18.4
3.18.5
3.18.6
3.18.7
3.18.8
3.19.0
3.20.0
3.20.1
3.20.2
3.20.3
3.20.4
3.20.5
3.20.6
3.20.7
3.20.8
3.20.9
3.21.0
3.21.1
3.21.2
3.21.3

Maven / org.apache.camel:camel-cassandraql

Package

Name
org.apache.camel:camel-cassandraql
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-cassandraql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.22.0
Fixed
3.22.1

Affected versions

3.*

3.22.0

Maven / org.apache.camel:camel-cassandraql

Package

Name
org.apache.camel:camel-cassandraql
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-cassandraql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.4

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3

Maven / org.apache.camel:camel-cassandraql

Package

Name
org.apache.camel:camel-cassandraql
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-cassandraql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.4.0

Affected versions

4.*

4.1.0
4.2.0
4.3.0