CVE-2017-3159

CRITICAL

Apache Camel < 2.14.4 - Insecure Deserialization

Title source: rule

Description

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

References (7)

[Vendor Advisory] http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2017/05/22/2

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/96321

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:0868

[Mailing List] https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

[Third Party Advisory] https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0277

EPSS Percentile 85.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status draft

Affected Products (2)

apache/camel < 2.14.4

org.apache.camel/camel-snakeyaml < 2.17.5Maven

Timeline

Published Mar 07, 2017

Tracked Since Feb 18, 2026