CVE-2017-12633

CRITICAL

Apache Camel 2.0.0-2.19.3 and 2.20.0 - Deserialization of Untrusted Data in camel-hessian

Title source: llm

Description

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101874

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0319

Issue Tracking, Vendor Advisory x_refsource_confirm

https://issues.apache.org/jira/browse/CAMEL-11923

Issue Tracking, Vendor Advisory x_refsource_confirm

http://camel.apache.org/security-advisories.data/CVE-2017-12633.txt.asc

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E

Scores

CVSS v3 9.8

EPSS 0.0341

EPSS Percentile 87.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-502

Status published

Products (5)

apache/camel 2.0.0 - 2.19.4

Apache Software Foundation/Apache Camel 2.19.0 to 2.19.3

Apache Software Foundation/Apache Camel 2.20.0

Apache Software Foundation/Apache Camel The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.

org.apache.camel/camel-hessian 2.0 - 2.19.4Maven

Published Nov 15, 2017

Tracked Since Feb 18, 2026