Apache Camel security advisory
CVE-2015-5348
Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability.
Description
Apache Camel's Jetty/Servlet usage is vulnerable to Java object de-serialisation vulnerability
Mitigation
2.15.x users should upgrade to 2.15.5, 2.16.0 users should upgrade to 2.16.1.
Credit
This issue was discovered by Sim Yih Tsern.
Notes
If using camel-jetty, or camel-servlet as a consumer in Camel routes, then Camel will automatic de-serialize HTTP requests that uses the content-header: application/x-java-serialized-object.
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-9309 refers to the various commits that resovoled the issue.