Apache Camel security advisory
CVE-2020-11973
Apache Camel Netty enables Java deserialization by default
Description
Apache Camel Netty enables Java deserialization by default
Mitigation
2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0
Credit
This issue was discovered by Colm O. HEigeartaigh <coheigea at apache dot org> from Apache Software Foundation
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-14477 refers to the various commits that resovoled the issue, and have more details.