CVE-2017-3159: Critical severity Apache Camel vulnerability
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
External References:
http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc
Upstream bug:
https://issues.apache.org/jira/browse/CAMEL-10575
Other sources
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
— MITRE
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization. De-serializing untrusted data can lead to security flaws.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.camel:camel-snakeyamlto a version that resolves this vulnerability.Fixed in 2.18.2 - Upgrade
Upgrade
maven/org.apache.camel:camel-snakeyamlto a version that resolves this vulnerability.Fixed in 2.17.5 - Upgrade
Upgrade
redhat/camel-snakeyamlto a version that resolves this vulnerability.Fixed in 2.17.5
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3159?
CVE-2017-3159 has a moderate severity level due to the potential for exploitation through Java object de-serialization.
How do I fix CVE-2017-3159?
To remediate CVE-2017-3159, upgrade the camel-snakeyaml component to version 2.18.2 or apply the patch available for version 2.17.5.
What is the impact of CVE-2017-3159?
The impact of CVE-2017-3159 includes the risk of remote code execution if untrusted data is de-serialized.
Which versions of Apache Camel are affected by CVE-2017-3159?
Apache Camel versions prior to 2.18.2, including 2.14.4, 2.17.0 to 2.17.4, and 2.18.0 to 2.18.1 are affected by CVE-2017-3159.
Is there a workaround for CVE-2017-3159?
No specific workarounds are recommended for CVE-2017-3159; upgrading to the fixed version is the best approach.