CVE-2016-8749

CRITICAL

Apache Camel < - RCE

Title source: llm

Description

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

References (7)

[Vendor Advisory] http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2017/05/22/2

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97179

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:1832

[Exploit, Technical Description, Third Party Advisory] https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

View Exploit ZIP pw:eip

[Mailing List] https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

Scores

CVSS v3 9.8

EPSS 0.1225

EPSS Percentile 93.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status draft

Affected Products (13)

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

apache/camel

org.apache.camel/camel-jackson < 2.16.5Maven

Timeline

Published Mar 28, 2017

Tracked Since Feb 18, 2026