Published: 28/03/2017 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache camel 2.17.0
apache camel 2.17.2
apache camel 2.17.4
apache camel 2.16.0
apache camel 2.16.4
apache camel 2.16.3
apache camel 2.17.3
apache camel 2.18.0
apache camel 2.16.1
apache camel 2.17.1
apache camel 2.16.2
apache camel 2.18.1

It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability Camel allows such a type through the 'CamelJacksonUnmarshalType' property De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues ...

Insecure Java Deserialization in the Jackson Library & How It Can Escalate to RCE Insecure deserialization is a security vulnerability that occurs when a software application deserializes data from an untrusted or malicious source without proper validation and protection This vulnerability can be exploited by attackers to execute arbitrary code, gain unauthorized acces

CWE-502 http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2 http://www.securityfocus.com/bid/97179 https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true http://www.openwall.com/lists/oss-security/2017/05/22/2 https://access.redhat.com/errata/RHSA-2017:1832 https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E https://nvd.nist.gov https://github.com/Jake-Schoellkopf/Insecure-Java-Deserialization https://access.redhat.com/security/cve/cve-2016-8749

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2016-8749

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect