Apache Camel security advisory
CVE-2017-12634
Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks
Description
Apache Camel's camel-castor component is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Mitigation
2.19.x users should upgrade to 2.19.4, 2.20.0 users should upgrade to 2.20.1.
Credit
This issue was discovered by Man Yue Mo <mmo at semmle dot com> from Semmle/lgtm.com.
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-11929 refers to the various commits that resovoled the issue, and have more details.