This is an automated email from the ASF dual-hosted git repository. acosentino pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/camel.git
commit 34ac4a853f40f1610e263dd88335dc9e225c0b18 Author: Andrea Cosentino <[email protected]> AuthorDate: Wed Sep 12 13:43:53 2018 +0200 Security Advisories: Porting to docs --- .../en/security-advisories/CVE-2017-3159.txt.asc | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/docs/user-manual/en/security-advisories/CVE-2017-3159.txt.asc b/docs/user-manual/en/security-advisories/CVE-2017-3159.txt.asc new file mode 100644 index 0000000..884e78a --- /dev/null +++ b/docs/user-manual/en/security-advisories/CVE-2017-3159.txt.asc @@ -0,0 +1,33 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +CVE-2017-3159: Apache Camel's Snakeyaml unmarshalling operation is vulnerable +to Remote Code Execution attacks + +Severity: MEDIUM + +Vendor: The Apache Software Foundation + +Versions Affected: Camel 2.17.0 to 2.17.4, Camel 2.18.0 to 2.18.1 +The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. + +Description: Apache Camel's camel-snakeyaml component is vulnerable to Java object +de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. + +Mitigation: 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2. + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-10575 +refers to the various commits that resovoled the issue, and have more details. + +Credit: This issue was discovered by Moritz Bechler from AgNO3 GmbH & Co. +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v2.0.22 (GNU/Linux) + +iQEcBAEBAgAGBQJYmy8MAAoJEONOnzgC/0EAujYIAI7eOnnkKE7wcHXjMeqUUDrb +EyqEFaWuUWenUhx5PoVu2zQ0m9m1uRC3vzRQTJzZpN83WOlkDUlcXcJzLAWDy1AW +W9dHgDTaP2zbUIPKo4Zjy+pur9afirAMRasCS0NAWAETHVi54ZBpCFQVkxk72xdO +pLxAAnvTQfxbCfqEgTlzttU0ovaG4DOvAteQfpHZyjPxGaY3T15pAGK0ZOBvmd0T +jATx/Nk3CoSuC8n6ECAbBcenRtycRh6HwvA6HFDFpgR3EI/FOq2/ikG4bLyJdgTW +VsTmanwq4zKtlhQAAyQvfSJcr/7EoRL1k4Ui0D2oZvMat1fQnwOR13QQQmb73RU= +=U+u3 +-----END PGP SIGNATURE-----
