CVE-2015-5344.txt.asc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================

CVE-2015-5344: Apache Camel's XStream usage is vulnerable
to Remote Code Execution attacks

Severity: MEDIUM

Vendor: The Apache Software Foundation

Versions Affected: Camel 2.15.0 to 2.15.4, Camel 2.16.0
The unsupported Camel 2.x (2.14 and earlier) versions may be also affected.

Description: Apache Camel's camel-xstream component is vulnerable to Java object
de-serialisation vulnerability. Such as de-serializing untrusted data can lead
to security flaws as demonstrated in various similar reports about Java de-serialization issues.

Mitigation: 2.15.x users should upgrade to 2.15.5, 2.16.0 users should
upgrade to 2.16.1. And if you are using camel-xstream to serialize payload to Java objects,
then you need to explicitly list trusted packages. 

To see how to do that, please take a look at: http://camel.apache.org/xstream

The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-9297
refers to the various commits that resovoled the issue, and have more details.

Credit: This issue was discovered by Christian Schneider.

A related xstream de-serialization vulnerability was recently reported for Apache ActiveMQ:
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt?version=1&modificationDate=1449589734000&api=v2


=============================================
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJWqyUtAAoJEN1wUKdrQA9p+ooP+wRwqVaLWcCpVNur91oJY7Ez
w0x+Rl/tNsGX6U/1Mow/iJSYPSvaDhjrfCUgwLYlhLp3MDvkYE5C9e2nBkQU1Jjl
REo2R0t8NmOARqF9pvZIDKj0F2/JViaOB/gT3ENZSDbroX1T78jr4kL6Ro48VrVj
4WyAdTgRR73t/2e/R8S+H+ObjkzCYvdcRI7swXdlrJhDy93t08ebf69UpxL5Zdr2
Dk/yavsYqYDGObAVCgdkAMiMayNeEjPbb+dD4DnohTs5egXkCfc0Dqg1/l/NdTK9
ONTlGeFyNNLCAoyNd8iJZPR0mwi/juAfVA2zqabnMoZvosM6YwXqjzg8/5OLbaiZ
765Dr7wP+zgUmB0y7AR+LMqjCvaw2jprOo17jtjMEBOAojaWWEJTl3ZBTdLYDAKE
qfpbwPLcY+sBdBO93LM6g92kQ3AFnH3Gcc3J1dKvQuI2NEd/0EfKWGCCAMXXaHg/
9hJjtWgCuzIXqHXptcu5CzfU0QPyNd30+3HpgEYR2XavUi4RVm+FvqPZh6b67ZHX
X7GsRGkLcSFbDFtSAhLYKTp0P50AKo7l2W16ZZFJi0v7c9cZ7J1UbyjQxa67gfR4
yH23PYKU3Bh7U1gZiqDVRw8jXjAuc5WLH/fJg4e0Vrlhxa2W8qcykSu745T9b7+9
Hu/gcBdRJG8ZWo9XzSsH
=zUaO
-----END PGP SIGNATURE-----