Bug 2265053 (CVE-2024-23114) - CVE-2024-23114 Apache Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
Summary: CVE-2024-23114 Apache Camel-CassandraQL: Unsafe Deserialization from Cassandr...
Keywords:
Status: NEW
Alias: CVE-2024-23114
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2265055
TreeView+ depends on / blocked
 
Reported: 2024-02-20 05:05 UTC by Avinash Hanwate
Modified: 2024-10-22 18:29 UTC (History)
14 users (show)

Fixed In Version: Apache Camel 3.21.4, Apache Camel 3.22.1, Apache Camel 4.0.4, Apache Camel 4.4.0
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:8339 0 None None None 2024-10-22 18:29:35 UTC

Description Avinash Hanwate 2024-02-20 05:05:05 UTC 
Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions, it is possible to deserialize malicious payload. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, and from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

This issue is being tracked as CAMEL-20306 

https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-23114
https://issues.apache.org/jira/browse/CAMEL-20306
Comment 4 errata-xmlrpc 2024-10-22 18:29:34 UTC 
This issue has been addressed in the following products:

  RHINT Camel-K 1.10.8

Via RHSA-2024:8339 https://access.redhat.com/errata/RHSA-2024:8339
Note You need to log in before you can comment on or make changes to this bug.