Bug 2265057 (CVE-2024-22369)

Summary:	CVE-2024-22369 Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, chazlett, cmiranda, dhanak, fmariani, fmongiar, gmalinko, ibek, janstey, jnethert, jpoth, jrokos, kverlaen, mnovotny, pcongius, pdelbell, pjindal, rguimara, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Apache Camel 3.21.4, Apache Camel 3.22.1, Apache Camel 4.0.4, Apache Camel 4.4.0	Doc Type:	---
Doc Text:	A deserialization of untrusted data flaw was found in Apache Camel SQL Component JDBCAggregationRepository. The affected versions of Apache Camel are vulnerable to unsafe deserialization, where, under specific conditions, it is possible to deserialize a malicious payload.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2265055

Description Avinash Hanwate 2024-02-20 05:18:59 UTC

Deserialization of Untrusted Data vulnerability in Apache Camel SQL Component. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, and from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

This issue is being tracked as CAMEL-20303.

https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-22369
https://issues.apache.org/jira/browse/CAMEL-20303