Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0. References: http://www.openwall.com/lists/oss-security/2020/05/14/9 https://camel.apache.org/security/CVE-2020-11973.html
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details
Statement: Red Hat JBoss Fuse 6 and Red Hat Fuse 7 distribute camel with the affected `camel-netty` component. However both Fuse 6 and Fuse 7 have deprecated the `camel-netty` component which uses netty 3.x in favour of `camel-netty4` netty 4.x, `camel-netty4` is not affected by this flaw; the `camel-netty` component is deprecated and should no longer be used.
Mitigation: Red Hat JBoss Fuse 6 & Red Hat Fuse 7 customers should use `camel-netty4` instead
This issue has been addressed in the following products: Red Hat Fuse 7.8.0 Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11973