critical9.8
CVE-2020-11973
Apache Camel Netty enables Java deserialization by default.
Impact
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Camel | from 2.22.0 through 2.25.0 from 3.0.0 through 3.1.0 |
| Oracle | Communications Diameter Signaling Router | from 8.0.0 through 8.5.0 |
| Oracle | Enterprise Manager Base Platform | Versions 13.3.0.0, 13.4.0.0 |
| Oracle | Flexcube Private Banking | Versions 12.0.0, 12.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2020/05/14/9
- https://camel.apache.org/security/CVE-2020-11973.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://www.openwall.com/lists/oss-security/2020/05/14/9
- https://camel.apache.org/security/CVE-2020-11973.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html