This is an automated email from the ASF dual-hosted git repository. acosentino pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/camel.git
commit 6e867514759e13ce4f0b04b9a11598167dee58d5 Author: Andrea Cosentino <[email protected]> AuthorDate: Wed Sep 12 13:42:25 2018 +0200 Security Advisories: Porting to docs --- .../en/security-advisories/CVE-2015-5344.txt.asc | 52 ++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/docs/user-manual/en/security-advisories/CVE-2015-5344.txt.asc b/docs/user-manual/en/security-advisories/CVE-2015-5344.txt.asc new file mode 100644 index 0000000..0fac84c --- /dev/null +++ b/docs/user-manual/en/security-advisories/CVE-2015-5344.txt.asc @@ -0,0 +1,52 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================= + +CVE-2015-5344: Apache Camel's XStream usage is vulnerable +to Remote Code Execution attacks + +Severity: MEDIUM + +Vendor: The Apache Software Foundation + +Versions Affected: Camel 2.15.0 to 2.15.4, Camel 2.16.0 +The unsupported Camel 2.x (2.14 and earlier) versions may be also affected. + +Description: Apache Camel's camel-xstream component is vulnerable to Java object +de-serialisation vulnerability. Such as de-serializing untrusted data can lead +to security flaws as demonstrated in various similar reports about Java de-serialization issues. + +Mitigation: 2.15.x users should upgrade to 2.15.5, 2.16.0 users should +upgrade to 2.16.1. And if you are using camel-xstream to serialize payload to Java objects, +then you need to explicitly list trusted packages. + +To see how to do that, please take a look at: http://camel.apache.org/xstream + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-9297 +refers to the various commits that resovoled the issue, and have more details. + +Credit: This issue was discovered by Christian Schneider. + +A related xstream de-serialization vulnerability was recently reported for Apache ActiveMQ: +http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt?version=1&modificationDate=1449589734000&api=v2 + + +============================================= +-----BEGIN PGP SIGNATURE----- +Comment: GPGTools - https://gpgtools.org + +iQIcBAEBCgAGBQJWqyUtAAoJEN1wUKdrQA9p+ooP+wRwqVaLWcCpVNur91oJY7Ez +w0x+Rl/tNsGX6U/1Mow/iJSYPSvaDhjrfCUgwLYlhLp3MDvkYE5C9e2nBkQU1Jjl +REo2R0t8NmOARqF9pvZIDKj0F2/JViaOB/gT3ENZSDbroX1T78jr4kL6Ro48VrVj +4WyAdTgRR73t/2e/R8S+H+ObjkzCYvdcRI7swXdlrJhDy93t08ebf69UpxL5Zdr2 +Dk/yavsYqYDGObAVCgdkAMiMayNeEjPbb+dD4DnohTs5egXkCfc0Dqg1/l/NdTK9 +ONTlGeFyNNLCAoyNd8iJZPR0mwi/juAfVA2zqabnMoZvosM6YwXqjzg8/5OLbaiZ +765Dr7wP+zgUmB0y7AR+LMqjCvaw2jprOo17jtjMEBOAojaWWEJTl3ZBTdLYDAKE +qfpbwPLcY+sBdBO93LM6g92kQ3AFnH3Gcc3J1dKvQuI2NEd/0EfKWGCCAMXXaHg/ +9hJjtWgCuzIXqHXptcu5CzfU0QPyNd30+3HpgEYR2XavUi4RVm+FvqPZh6b67ZHX +X7GsRGkLcSFbDFtSAhLYKTp0P50AKo7l2W16ZZFJi0v7c9cZ7J1UbyjQxa67gfR4 +yH23PYKU3Bh7U1gZiqDVRw8jXjAuc5WLH/fJg4e0Vrlhxa2W8qcykSu745T9b7+9 +Hu/gcBdRJG8ZWo9XzSsH +=zUaO +-----END PGP SIGNATURE-----
