CVE-2017-12634: Critical severity red hat build of apache camel vulnerability
Apache Camel's camel-castor component is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Versions Affected: Camel 2.19.0 to 2.19.3 and Camel 2.20.0 The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.
References:
https://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc https://issues.apache.org/jira/browse/CAMEL-11929
Other sources
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-12634?
CVE-2017-12634 is a vulnerability in the camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 that can be exploited through Java object deserialization.
How does CVE-2017-12634 affect Apache Camel?
CVE-2017-12634 affects Apache Camel versions 2.x before 2.19.4 and 2.20.x before 2.20.1, specifically the camel-castor component.
What is the severity of CVE-2017-12634?
CVE-2017-12634 has a severity of 9.8 (Critical).
How can CVE-2017-12634 be fixed?
To fix CVE-2017-12634, upgrade to Apache Camel version 2.19.4 or newer for the 2.x line, or version 2.20.1 or newer for the 2.20.x line.
Where can I find more information about CVE-2017-12634?
You can find more information about CVE-2017-12634 in the official security advisories from Apache Camel, as well as in the related JIRA and Red Hat Bugzilla reports.