by Kastro CVE-2024-23114
Apache Software Foundation Apache Camel — Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
Description · from the CVE record
Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Affected
ProductAffectedFixed inSource
Apache Camel3.0.0 – < 3.21.43.21.4CNA
Apache Camel3.22.0 – < 3.22.13.22.1CNA
Apache Camel4.0.0 – < 4.0.44.0.4CNA
Apache Camel4.1.0 – < 4.4.04.4.0CNA
camel3.0.0 – < 3.21.43.21.4CISA-ADP
camel3.22.0 – < 3.22.13.22.1CISA-ADP
camel4.0.0 – < 4.0.44.0.4CISA-ADP
camel4.1.0 – < 4.4.04.4.0CISA-ADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total