What is GHSA-h79p-32mx-fjj9?

GHSA-h79p-32mx-fjj9 is a security advisory published by GitHub Security Advisories with Critical severity. Apache Camel Netty enables Java deserialization by default

Which CVE IDs does GHSA-h79p-32mx-fjj9 cover?

GHSA-h79p-32mx-fjj9 covers the following CVE IDs: CVE-2020-11973. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h79p-32mx-fjj9?

GHSA-h79p-32mx-fjj9 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-h79p-32mx-fjj9?

GHSA-h79p-32mx-fjj9 affects 1 product, including: maven/org.apache.camel:camel-netty:\u003e= 3.0.0, \u003c 3.2.0.

GHSA-h79p-32mx-fjj9CriticalCVSS 9.8

Apache Camel Netty enables Java deserialization by default

Vendor

GitHub Security Advisories

Published

May 21, 2020

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-11973 →

📋 Description

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

🎯 Affected products1

maven/org.apache.camel:camel-netty:>= 3.0.0, < 3.2.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2020-11973
https://camel.apache.org/security/CVE-2020-11973.html
http://www.openwall.com/lists/oss-security/2020/05/14/9
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://github.com/advisories/GHSA-h79p-32mx-fjj9