camel-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Claus Ibsen <>
Subject CVE-2015-5348 - Apache Camel medium disclosure vulnerability
Date Thu, 17 Dec 2015 09:27:59 GMT
Apache Camel's Jetty/Servlet usage is vulnerable to Java object
de-serialisation vulnerability

If using camel-jetty, or camel-servlet as a consumer in Camel routes,
then Camel will automatic de-serialize HTTP requests that uses the
content-header: application/x-java-serialized-object.

Please study this security vulnerability carefully!

CVE-2015-5348 - [1]

You can download the fixed Apache Camel 2.15.x and 2.16.x version from the
Apache mirrors [2] or from the Central Maven repository.


On behalf of the Camel PMC,
Claus Ibsen

Claus Ibsen
----------------- @davsclaus
Camel in Action 2:

View raw message