| title | Apache Camel Security Advisory - CVE-2020-11972 |
|---|---|
| date | 2020-05-14 14:47:42 +0200 |
| url | /security/CVE-2020-11972.html |
| draft | false |
| type | security-advisory |
| cve | CVE-2020-11972 |
| severity | MEDIUM |
| summary | Apache Camel RabbitMQ enables Java deserialization by default |
| description | Apache Camel RabbitMQ enables Java deserialization by default |
| mitigation | 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0 |
| credit | This issue was discovered by Colm O. HEigeartaigh <coheigea at apache dot org> from Apache Software Foundation |
| affected | 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 |
| fixed | 2.25.1, 3.2.0 |
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-14711 refers to the various commits that resovoled the issue, and have more details.