Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object deserialization

Summaryinfo

A vulnerability identified as critical has been detected in Apache Camel up to 2.19.3/2.20.0. This affects an unknown part of the component camel-castor. Performing a manipulation as part of Java Object results in deserialization. This vulnerability is cataloged as CVE-2017-12634. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Camel up to 2.19.3/2.20.0. It has been classified as critical. This affects some unknown functionality of the component camel-castor. The manipulation as part of a Java Object leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

The bug was discovered 08/07/2017. The weakness was shared 11/15/2017 by Man Yue Mo (Website). It is possible to read the advisory at camel.apache.org. This vulnerability is uniquely identified as CVE-2017-12634 since 08/07/2017. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 100 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 2.19.4 or 2.20.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 101876†). The entry VDB-109418 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Camel

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.19.0
• 2.19.1
• 2.19.2
• 2.19.3
• 2.20.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion