Bug 2265053 (CVE-2024-23114)

Summary:	CVE-2024-23114 Apache Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, chazlett, cmiranda, fmariani, fmongiar, gmalinko, janstey, jnethert, jpoth, pcongius, pdelbell, pjindal, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Apache Camel 3.21.4, Apache Camel 3.22.1, Apache Camel 4.0.4, Apache Camel 4.4.0	Doc Type:	---
Doc Text:	A deserialization of untrusted data flaw was found in the Apache Camel CassandraQL Component AggregationRepository. The affected versions of Apache Camel are vulnerable to unsafe deserialization, where, under specific conditions, it is possible to deserialize a malicious payload.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2265055

Description Avinash Hanwate 2024-02-20 05:05:05 UTC

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions, it is possible to deserialize malicious payload. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, and from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

This issue is being tracked as CAMEL-20306 

https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-23114
https://issues.apache.org/jira/browse/CAMEL-20306

Comment 4 errata-xmlrpc 2024-10-22 18:29:34 UTC

This issue has been addressed in the following products:

  RHINT Camel-K 1.10.8

Via RHSA-2024:8339 https://access.redhat.com/errata/RHSA-2024:8339