CVE-2020-11973

published 2020-05-14

CVE-2020-11973: Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	camel	—	—
apache	camel	2.22.0 – 2.25.0	—
apache	camel	3.0.0 – 3.1.0	—
oracle	communications_diameter_signaling_router	8.0.0 – 8.5.0	—
oracle	enterprise_manager_base_platform	—	—
oracle	enterprise_manager_base_platform	—	—
oracle	flexcube_private_banking	—	—
oracle	flexcube_private_banking	—	—

CWE-502