This is an automated email from the ASF dual-hosted git repository. acosentino pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/camel.git
commit 7215c1e9ebc4f0b5411983c0ba14d3a48730c487 Author: Andrea Cosentino <[email protected]> AuthorDate: Wed Sep 12 13:45:40 2018 +0200 Security Advisories: Porting to docs --- .../en/security-advisories/CVE-2017-12634.txt.asc | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/docs/user-manual/en/security-advisories/CVE-2017-12634.txt.asc b/docs/user-manual/en/security-advisories/CVE-2017-12634.txt.asc new file mode 100644 index 0000000..de9771f --- /dev/null +++ b/docs/user-manual/en/security-advisories/CVE-2017-12634.txt.asc @@ -0,0 +1,33 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +CVE-2017-12634: Apache Camel's Castor unmarshalling operation is vulnerable +to Remote Code Execution attacks + +Severity: MEDIUM + +Vendor: The Apache Software Foundation + +Versions Affected: Camel 2.19.0 to 2.19.3 and Camel 2.20.0 +The unsupported Camel 2.x (2.18 and earlier) versions may be also affected. + +Description: Apache Camel's camel-castor component is vulnerable to Java object +de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. + +Mitigation: 2.19.x users should upgrade to 2.19.4, 2.20.0 users should upgrade to 2.20.1. + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-11929 +refers to the various commits that resovoled the issue, and have more details. + +Credit: This issue was discovered by Man Yue Mo <mmo at semmle dot com> from Semmle/lgtm.com. +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.0.22 (GNU/Linux) + +iQEcBAEBAgAGBQJaC/hNAAoJEONOnzgC/0EAjcgH/0pwXq7bn9HTnKJOswZ64QWA +7yhFD2UASVaV3jZJnl/gavlHeLXqGdi+jBs2INxveNF9MWdSacRfi6aO+4scYZDw +18Ra+nH2FVeIeO3VhrI0WQTTK9TNByLmiZ3Rn0v2eH06XV7Oc3MR5JsdEHBR3YCx +T6TLqGB8QD/fXICmr5ztLeIVAWMFhThNVHiNX281cOtiyZrWWNHGfJAKTPEVz+nL +/EiNn7M2o/8NGWNVr1rC+yBAGxoMrSd7eyNoMC7kd42uF+rpJWzi/QE8we6wQrDO +3hhzUJsmAHv+Ap/97gp/Z+plDvysDREj3YnFMUFrJkJeBVqeg5c8XJGTiwMCN+k= +=Cb8h +-----END PGP SIGNATURE-----
