CVE-2020-11972: Apache Camel RabbitMQ Deserialization of Untrusted Data
Summary
CVE-2020-11972: Deserialization of Untrusted Data in Apache Camel RabbitMQ. Affects org.apache.camel:camel-rabbitmq across 2 version ranges.
< 2.25.1
>= 3.0.0, < 3.2.0
Fixed in 2.25.1 or 3.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel RabbitMQ is a component of the Apache Camel integration framework that enables Java deserialization. It provides functionality for integrating RabbitMQ messaging into Camel routes. This vulnerability affects versions 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0. Users of version 2.x should upgrade to 2.25.1, while users of version 3.x should upgrade to 3.2.0.
Vulnerability Detail
The vulnerability in Apache Camel RabbitMQ arises from its default Java deserialization behavior. This can be exploited by an attacker to execute arbitrary code by sending maliciously crafted data. The impact of this vulnerability is significant, as it allows an attacker to gain unauthorized access, manipulate data, or disrupt the system. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-502.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.25.12.25.1 -
>= 3.0.0, < 3.2.03.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions mentioned above.
Conclusion
Apache Camel RabbitMQ is vulnerable to deserialization of untrusted data, which can lead to arbitrary code execution. Users should upgrade to the fixed versions (2.25.1 for version 2.x and 3.2.0 for version 3.x) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-rabbitmq →
FAQ
Apache Camel RabbitMQ is a component of the Apache Camel integration framework that enables the integration of RabbitMQ messaging into Camel routes.
This vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data manipulation, or system disruption.
Versions 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected.
Users of version 2.x should upgrade to 2.25.1, while users of version 3.x should upgrade to 3.2.0.
There is no known workaround. It is recommended to upgrade to the fixed versions.
