| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA1 |
| |
| CVE-2020-11972: Apache Camel RabbitMQ enables Java deserialization by default |
| |
| Severity: MEDIUM |
| |
| Vendor: The Apache Software Foundation |
| |
| Versions Affected: Camel 2.25.0, Camel 3.0.0 to 3.1.0. The unsupported Camel 2.x (2.24 and earlier) versions may be also affected. |
| |
| Description: Apache Camel RabbitMQ enables Java deserialization by default |
| |
| Mitigation: 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0 The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-14711 refers to the various commits that resovoled the issue, and have more details. |
| |
| Credit: This issue was discovered by Colm O. HEigeartaigh <coheigea at apache dot org> from Apache Software Foundation |
| -----BEGIN PGP SIGNATURE----- |
| Version: GnuPG v2.0.22 (GNU/Linux) |
| |
| iQEcBAEBAgAGBQJevUQmAAoJEONOnzgC/0EAoUEH/3gQSJ+agSsG/NujZ2xffXRw |
| YvfSHRzlWKKailRrTA0M7400YcLcY0vWJm+7lq2IBxCwQ+YXV5sn5k9IbztCaXi+ |
| NkfuScPghlCk6ysYW4ipkNQKHjCkT2IRDHH460vfBNlD07P2wlnF+Wd9DnE5ssBv |
| lKt0sbfUwd8Wd6DGt6IfR42f/yNtBRC9B/JLIY5Ch2InptI3kB3xKjOzw/VvL69L |
| nJfu9L/oGX8UbOy3xLrQUp9MfNK5ymtiOW/xKVJbW6icoU3qopz0uQk3oIo5HRvi |
| 34fhmRBJ8fSguS3xC2VWBuQKCy765EaCB0X95vesM8/9TNTKmdr71AjKrye0i3o= |
| =+Dlv |
| -----END PGP SIGNATURE----- |
