CVE-2024-22369

CWE-502 — Deserialization of Untrusted Data6 documents6 sources

Severity

7.8HIGH

EPSS

4.8%

top 10.56%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Camel Apache Camel

Timeline

PublishedFeb 20

Description

Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/camel3.0.0 — 3.21.4+3

▶Mavenorg.apache.camel:camel-sql3.0.0 — 3.21.4+3

▶CVEListV5apache_software_foundation/apache_camel3.0.0 — 3.21.4+3

🔴Vulnerability Details

GHSA

Deserialization of Untrusted Data in Apache Camel SQL↗2024-02-20

▶

CVEList

Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository↗2024-02-20

▶

OSV

Deserialization of Untrusted Data in Apache Camel SQL↗2024-02-20

▶

📋Vendor Advisories

Red Hat

Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository↗2024-02-19

▶

Apache

Apache camel: CVE-2024-22369↗

▶