| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA512 |
| |
| ============================================= |
| |
| CVE-2015-5344: Apache Camel's XStream usage is vulnerable |
| to Remote Code Execution attacks |
| |
| Severity: MEDIUM |
| |
| Vendor: The Apache Software Foundation |
| |
| Versions Affected: Camel 2.15.0 to 2.15.4, Camel 2.16.0 |
| The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. |
| |
| Description: Apache Camel's camel-xstream component is vulnerable to Java object |
| de-serialisation vulnerability. Such as de-serializing untrusted data can lead |
| to security flaws as demonstrated in various similar reports about Java de-serialization issues. |
| |
| Mitigation: 2.15.x users should upgrade to 2.15.5, 2.16.0 users should |
| upgrade to 2.16.1. And if you are using camel-xstream to serialize payload to Java objects, |
| then you need to explicitly list trusted packages. |
| |
| To see how to do that, please take a look at: http://camel.apache.org/xstream |
| |
| The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-9297 |
| refers to the various commits that resovoled the issue, and have more details. |
| |
| Credit: This issue was discovered by Christian Schneider. |
| |
| A related xstream de-serialization vulnerability was recently reported for Apache ActiveMQ: |
| http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt?version=1&modificationDate=1449589734000&api=v2 |
| |
| |
| ============================================= |
| -----BEGIN PGP SIGNATURE----- |
| Comment: GPGTools - https://gpgtools.org |
| |
| iQIcBAEBCgAGBQJWqyUtAAoJEN1wUKdrQA9p+ooP+wRwqVaLWcCpVNur91oJY7Ez |
| w0x+Rl/tNsGX6U/1Mow/iJSYPSvaDhjrfCUgwLYlhLp3MDvkYE5C9e2nBkQU1Jjl |
| REo2R0t8NmOARqF9pvZIDKj0F2/JViaOB/gT3ENZSDbroX1T78jr4kL6Ro48VrVj |
| 4WyAdTgRR73t/2e/R8S+H+ObjkzCYvdcRI7swXdlrJhDy93t08ebf69UpxL5Zdr2 |
| Dk/yavsYqYDGObAVCgdkAMiMayNeEjPbb+dD4DnohTs5egXkCfc0Dqg1/l/NdTK9 |
| ONTlGeFyNNLCAoyNd8iJZPR0mwi/juAfVA2zqabnMoZvosM6YwXqjzg8/5OLbaiZ |
| 765Dr7wP+zgUmB0y7AR+LMqjCvaw2jprOo17jtjMEBOAojaWWEJTl3ZBTdLYDAKE |
| qfpbwPLcY+sBdBO93LM6g92kQ3AFnH3Gcc3J1dKvQuI2NEd/0EfKWGCCAMXXaHg/ |
| 9hJjtWgCuzIXqHXptcu5CzfU0QPyNd30+3HpgEYR2XavUi4RVm+FvqPZh6b67ZHX |
| X7GsRGkLcSFbDFtSAhLYKTp0P50AKo7l2W16ZZFJi0v7c9cZ7J1UbyjQxa67gfR4 |
| yH23PYKU3Bh7U1gZiqDVRw8jXjAuc5WLH/fJg4e0Vrlhxa2W8qcykSu745T9b7+9 |
| Hu/gcBdRJG8ZWo9XzSsH |
| =zUaO |
| -----END PGP SIGNATURE----- |
