lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 17 Dec 2015 10:27:59 +0100 From: Claus Ibsen <claus.ibsen@...il.com> To: dev <dev@...el.apache.org>, "users@...el.apache.org" <users@...el.apache.org>, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com, security <security@...che.org> Subject: CVE-2015-5348 - Apache Camel medium disclosure vulnerability Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatic de-serialize HTTP requests that uses the content-header: application/x-java-serialized-object. Please study this security vulnerability carefully! CVE-2015-5348 - [1] You can download the fixed Apache Camel 2.15.x and 2.16.x version from the Apache mirrors [2] or from the Central Maven repository. [1] http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc?version=1&modificationDate=1450340845000&api=v2 [2] http://camel.apache.org/download On behalf of the Camel PMC, Claus Ibsen -- Claus Ibsen ----------------- http://davsclaus.com @davsclaus Camel in Action 2: https://www.manning.com/ibsen2
Powered by blists - more mailing lists