GHSA-36xr-4x2f-cfj9
Deserialization of Untrusted Data in Apache Camel SQL
At a glance
- Published
- Updated
- CVE
- CVE-2024-22369
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Deserialization of Untrusted Data vulnerability in Apache Camel SQL Component. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.camel:camel-sql | introduced 3.0.0, fixed 3.21.4 |
| Maven · org.apache.camel:camel-sql | introduced 3.22.0, fixed 3.22.1 |
| Maven · org.apache.camel:camel-sql | introduced 4.0.0, fixed 4.0.4 |
| Maven · org.apache.camel:camel-sql | introduced 4.1.0, fixed 4.4.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-22369 ADVISORY
- https://github.com/apache/camel/pull/12706 WEB
- https://github.com/apache/camel/pull/12707 WEB
- https://github.com/apache/camel/pull/12708 WEB
- https://github.com/apache/camel/pull/12709 WEB
- https://github.com/apache/camel/pull/12716 WEB
- https://github.com/apache/camel/pull/12717 WEB
- https://github.com/apache/camel/pull/12718 WEB
- https://github.com/apache/camel/pull/12719 WEB
- https://github.com/apache/camel/pull/12789 WEB
- https://github.com/apache/camel PACKAGE
- https://github.com/oscerd/CVE-2024-22369 WEB
- https://issues.apache.org/jira/browse/CAMEL-20303 WEB
- https://lists.apache.org/thread/3dko781dy2gy5l3fs48p56fgp429yb0f WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |