by Kastro
Paper/Archive/CVE-2020-11973

CVE-2020-11973

apache — Apache Camel Netty enables Java deserialization by default.

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.0.940 × 2018.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Affected

ProductAffectedFixed inSource
Apache CamelApache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refopenwall.com/lists/oss-security/2020/05/14/9reforacle.com/security-alerts/cpuoct2020.htmlrefcamel.apache.org/security/CVE-2020-11973.htmlreforacle.com/security-alerts/cpujan2021.htmlreforacle.com/security-alerts/cpuApr2021.htmlreforacle.com//security-alerts/cpujul2021.html