CVE-2017-12633: Critical severity red hat build of apache camel vulnerability
Apache Camel's camel-hessian component is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Versions Affected: Camel 2.19.0 to 2.19.3 and Camel 2.20.0 The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.
References:
https://camel.apache.org/security-advisories.data/CVE-2017-12633.txt.asc https://issues.apache.org/jira/browse/CAMEL-11923
Other sources
It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize a malicious object on the target machine which could lead to Remote Code Execution (RCE).
The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12633?
The severity of CVE-2017-12633 is critical with a severity value of 9.8 on a scale of 1 to 10.
How does CVE-2017-12633 affect Apache Camel?
CVE-2017-12633 affects Apache Camel by allowing an attacker to deserialize a malicious object, potentially leading to Remote Code Execution (RCE).
Which versions of Apache Camel are affected by CVE-2017-12633?
Versions up to (exclusive) 2.19.4 and versions up to (exclusive) 2.20.1 of Apache Camel are affected by CVE-2017-12633.
How can CVE-2017-12633 be remediated?
CVE-2017-12633 can be remediated by updating to version 2.19.4 or later, or version 2.20.1 or later, of the camel-hessian component.
Where can I find more information about CVE-2017-12633?
More information about CVE-2017-12633 can be found at the following references: [1] [2] [3].