by Kastro
Paper/Archive/CVE-2020-11972

CVE-2020-11972

apache — Apache Camel RabbitMQ enables Java deserialization by default.

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.0.930 × 2018.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Affected

ProductAffectedFixed inSource
Apache CamelApache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refopenwall.com/lists/oss-security/2020/05/14/8refopenwall.com/lists/oss-security/2020/05/14/10reforacle.com/security-alerts/cpuoct2020.htmlrefcamel.apache.org/security/CVE-2020-11972.htmlreforacle.com/security-alerts/cpujan2021.html