Lucene search

ApacheCVE-2017-3159

HistoryMar 07, 2017 - 3:59 p.m.

CVE-2017-3159

2017-03-0715:59:00

CWE-502

apache

web.nvd.nist.gov

apache camel

camel-snakeyaml

cve-2017-3159

java

object de-serialization

vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.009

Percentile

83.0%

JSON

Apache Camel’s camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

Affected configurations

Nvd

Vulners

Node

apachecamelRange≤2.14.4

apachecamelRange2.17.0–2.17.4

apachecamelRange2.18.0–2.18.1

VendorProductVersionCPE
apachecamel*cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	camel	*	cpe:2.3:a:apache:camel::::::::

CNA Affected

[
  {
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.17.0 to 2.17.4"
      },
      {
        "status": "affected",
        "version": "2.18.0 to 2.18.1"
      },
      {
        "status": "affected",
        "version": "The unsupported Camel 2.x (2.14 and earlier) versions may be also affected."
      }
    ]
  }
]

References

camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1&modificationDate=1486565167000&api=v2

www.openwall.com/lists/oss-security/2017/05/22/2

www.securityfocus.com/bid/96321

access.redhat.com/errata/RHSA-2017:0868

lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E

lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.009

Percentile

83.0%

JSON

Related for CVE-2017-3159