CVE-2020-11972
published 2020-05-14CVE-2020-11972: Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.51%
91.9th percentile
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | — | — |
| apache | camel | 2.22.0 – 2.25.0 | — |
| apache | camel | 3.0.0 – 3.1.0 | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.2.2 | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | flexcube_private_banking | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_apache9.8MEDIUM
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Deserialization of Untrusted Data in Apache Camel RabbitMQ
osv·2021-05-21
CVE-2020-11972 [HIGH] Deserialization of Untrusted Data in Apache Camel RabbitMQ
Deserialization of Untrusted Data in Apache Camel RabbitMQ
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
GHSA
Deserialization of Untrusted Data in Apache Camel RabbitMQ
ghsa·2021-05-21
CVE-2020-11972 [HIGH] CWE-502 Deserialization of Untrusted Data in Apache Camel RabbitMQ
Deserialization of Untrusted Data in Apache Camel RabbitMQ
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Red Hat
camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
vendor_redhat·2020-05-14·CVSS 9.8
CVE-2020-11972 [CRITICAL] CWE-502 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
A flaw was found in camel up to versions 2.25.1 and 3.x. Apache Camel RabbitMQ enables java deserialization, by default, without any means of disabling which can lead to arbitrary code being executed. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: camel-rabbitmq (Red Hat JBoss Data Grid 7) - Not affected
Package: camel-rabbitmq (Red Hat JBoss Fuse 6) - Affected
Apache
Apache camel: CVE-2020-11972
vendor_apache·CVSS 9.8
CVE-2020-11972 [MEDIUM] Apache camel: CVE-2020-11972
Apache camel: CVE-2020-11972
2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 2.25.1, 3.2.0 MEDIUM Apache Camel RabbitMQ enables Java deserialization by default
Severity: medium
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-11972 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
bugzilla·2020-06-18·CVSS 9.8
CVE-2020-11972 [CRITICAL] CVE-2020-11972 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
CVE-2020-11972 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
References:
http://www.openwall.com/lists/oss-security/2020/05/14/10
http://www.openwall.com/lists/oss-security/2020/05/14/8
https://camel.apache.org/security/CVE-2020-11972.html
Discussion:
This issue has been addressed in the following products:
Red Hat Fuse 7.8.0
Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/
arXiv
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
arxiv_fulltext·2022-08-17
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
[Imen Sayar]Imen Sayar^
[email protected]
University of Toulouse
Blagnac
France
31070
^ Part of this research was conducted when Imen Sayar was at the University of Luxembourg
[Alexandre Bartel]Alexandre Bartel^*
[email protected]
Umeå University
MIT-Huset
Umeå
Sweden
^*Part of this research was conducted when Alexandre Bartel was at the University of Luxembourg and the University of Copenhagen.
Eric Bodden
[email protected]
Paderborn University
Paderborn
Germany
Yves Le Traon
[email protected]
University of Luxembourg
6, rue Richard Coudenhove-Kalergi
Kirchberg Campus
Luxembourg
L-1359
## Abstract
Nowadays, an increasing number of applications uses deserializatio
http://www.openwall.com/lists/oss-security/2020/05/14/10http://www.openwall.com/lists/oss-security/2020/05/14/8https://camel.apache.org/security/CVE-2020-11972.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://www.openwall.com/lists/oss-security/2020/05/14/10http://www.openwall.com/lists/oss-security/2020/05/14/8https://camel.apache.org/security/CVE-2020-11972.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html
2020-05-14
Published