[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE-2015-5344 - Apache Camel medium disclosure vulnerability
From: Claus Ibsen <claus.ibsen () gmail ! com>
Date: 2016-01-30 7:27:10
Message-ID: CAGB5yN=VtQWD15+7n9NoVVrJiZdwrvgXhpyU67ir2M78C2HfGw () mail ! gmail ! com
[Download RAW message or body]
Apache Camel's XStream usage is vulnerable to Remote Code Execution attacks
Apache Camel's camel-xstream component is vulnerable to Java object
de-serialisation vulnerability.
Such as de-serializing untrusted data can lead to security flaws as
demonstrated in various similar reports about Java de-serialization
issues.
Please study this security vulnerability carefully!
CVE-2015-5344 - [1]
You can download the fixed Apache Camel 2.15.x and 2.16.x version from
the Apache mirrors [2] or from the Central Maven repository.
[1] http://camel.apache.org/security-advisories.data/CVE-2015-5344.txt.asc?version=1&modificationDate=1454056803464&api=v2
[2] http://camel.apache.org/download
On behalf of the Camel PMC,
Claus Ibsen
--
Claus Ibsen
-----------------
http://davsclaus.com @davsclaus
Camel in Action 2: https://www.manning.com/ibsen2
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic