CVE-2017-3159.txt.asc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2017-3159: Apache Camel's Snakeyaml unmarshalling operation is vulnerable
to Remote Code Execution attacks

Severity: MEDIUM

Vendor: The Apache Software Foundation

Versions Affected: Camel 2.17.0 to 2.17.4, Camel 2.18.0 to 2.18.1
The unsupported Camel 2.x (2.14 and earlier) versions may be also affected.

Description: Apache Camel's camel-snakeyaml component is vulnerable to Java object
de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Mitigation: 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2. 

The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-10575
refers to the various commits that resovoled the issue, and have more details.

Credit: This issue was discovered by Moritz Bechler from AgNO3 GmbH & Co.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBAgAGBQJYmy8MAAoJEONOnzgC/0EAujYIAI7eOnnkKE7wcHXjMeqUUDrb
EyqEFaWuUWenUhx5PoVu2zQ0m9m1uRC3vzRQTJzZpN83WOlkDUlcXcJzLAWDy1AW
W9dHgDTaP2zbUIPKo4Zjy+pur9afirAMRasCS0NAWAETHVi54ZBpCFQVkxk72xdO
pLxAAnvTQfxbCfqEgTlzttU0ovaG4DOvAteQfpHZyjPxGaY3T15pAGK0ZOBvmd0T
jATx/Nk3CoSuC8n6ECAbBcenRtycRh6HwvA6HFDFpgR3EI/FOq2/ikG4bLyJdgTW
VsTmanwq4zKtlhQAAyQvfSJcr/7EoRL1k4Ui0D2oZvMat1fQnwOR13QQQmb73RU=
=U+u3
-----END PGP SIGNATURE-----