Vulnerabilities in pkg:maven/org.apache.camel/camel-http-common

PACKAGE
Advisory Identifier: GHSA-26v6-w6fw-rh94
Share
Advisory Summary

CVE-2015-5348 is a HIGH (CVSS 8.1) apache camel can allow remote vulnerability (General Security Weakness) affecting Camel jetty libraries in the Maven ecosystem. The issue involves apache camel can allow remote attackers to execute arbitrary commands. Remediation is available by upgrading affected packages to version 2.15.5, 2.16.1.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/org.apache.camel/camel-http-common

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.apache.camel/camel-http-common. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-26v6-w6fw-rh94 CVE-2015-5348 HIGH Apache Camel can allow remote attackers to execute arbitrary commands

CVE-2015-5348 at a Glance

CVE Identifier CVE-2015-5348
GHSA Identifier GHSA-26v6-w6fw-rh94
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification General Security Weakness
Affected Product Camel jetty
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2015-5348

To remediate this vulnerability, upgrade all affected Camel jetty dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.camel:camel-jetty fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jetty</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-jetty fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jetty</artifactId>
    <version>2.16.1</version>
</dependency>
org.apache.camel:camel-servlet fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-servlet</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-servlet fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-servlet</artifactId>
    <version>2.16.1</version>
</dependency>
org.apache.camel:camel-http fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-http fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http</artifactId>
    <version>2.16.1</version>
</dependency>
org.apache.camel:camel-http-common fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http-common</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-http-common fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http-common</artifactId>
    <version>2.16.1</version>
</dependency>
org.apache.camel:camel-http4 fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http4</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-http4 fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-http4</artifactId>
    <version>2.16.1</version>
</dependency>
org.apache.camel:camel-ahc fixed: 2.15.5 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-ahc</artifactId>
    <version>2.15.5</version>
</dependency>
org.apache.camel:camel-ahc fixed: 2.16.1 
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-ahc</artifactId>
    <version>2.16.1</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apache.camel

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2015-5348, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.camel

Analyze the terminal output to locate any version of Camel jetty in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.15.5), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.camel command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Camel jetty, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

CVE-2015-5348 Affected Camel jetty Versions

12 component(s)
Fixed Versions:
2.15.52.16.1
Product / Package Ecosystem Affected Versions Fixed Version
org.apache.camel:camel-jetty
maven/org.apache.camel/camel-jetty
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-jetty
maven/org.apache.camel/camel-jetty
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1
org.apache.camel:camel-servlet
maven/org.apache.camel/camel-servlet
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-servlet
maven/org.apache.camel/camel-servlet
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1
org.apache.camel:camel-http
maven/org.apache.camel/camel-http
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-http
maven/org.apache.camel/camel-http
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1
org.apache.camel:camel-http-common
maven/org.apache.camel/camel-http-common
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-http-common
maven/org.apache.camel/camel-http-common
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1
org.apache.camel:camel-http4
maven/org.apache.camel/camel-http4
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-http4
maven/org.apache.camel/camel-http4
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1
org.apache.camel:camel-ahc
maven/org.apache.camel/camel-ahc
Maven
< 2.15.5
2.15.5
org.apache.camel:camel-ahc
maven/org.apache.camel/camel-ahc
Maven
≥ 2.16.0
< 2.16.1
All 1 versions
2.16.0
2.16.1

References

NVD — CVE-2015-5348 NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5348
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/f7f0b18f6924fe0b01f32a25ed1e38e29b1bf8e5
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/e7fd5f049c2fd51a528f8062da91a1c75e33b0e8
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/d853853469292cd54fd9662c3605030ab5a9566b
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/c558f30a6d3820faa3d8c4ad5e54448914ec60d0
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/c47cffcadabca0c588753555a386942184a33627
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/a68434c258cdcd30587ae7adc5dabbac43eadbbf
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/9cbd5867fe73ef07ecba6f16d64689632e3f2a16
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/94330f99acb6f28155793b253de9956c3798f3bb
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/92081b203523c5ed502ed41df43cbd8655caf9b9
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/7e28d0af471ea992eb74807a4abd1626b88d678a
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/735ee02c693964b5f700af13a2adfeae56b848a4
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/5ea0a6f6c6a54f1cddf9691a99b0c237afc95348
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/515c822148d52de9e7cdf4f6b01f7b793f2f273f
Camel jetty Source Repository REPOSITORY
https://github.com/apache/camel
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/4f065fe07c1dcd7b451e6005a6dc8e96d77da43e
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/44e6a3036e5a11d90b60c142cf51ed74b792de31
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/349109b0834764560f0be69eb74f43a16bd220b0
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/32eacdaff16f8709da55e27b83fa21a16d739f63
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/1b1ccbcd94860f6f1d8caf98fb59e6ab7b3940b4
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/190d7c81b7e3ce767514e319630b1bbaf27e6817
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/13e43c1412ad72d99030b4eb4cb72c84fa57d5ff
Security Fix Commit FIX COMMIT
https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99a
issues.apache.org/jira/browse/camel-9... WEB
https://issues.apache.org/jira/browse/CAMEL-9309
lists.apache.org/thread.html/2318d7f... WEB
https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
lists.apache.org/thread.html/b4014ea... WEB
https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
GitHub Advisory / Wiki ADVISORY
https://github.com/advisories/GHSA-26v6-w6fw-rh94
Camel jetty Security Information SECURITY
http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc
Camel jetty Security Information SECURITY
http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html
rhn.redhat.com/errata/rhsa-2016-20... WEB
http://rhn.redhat.com/errata/RHSA-2016-2035.html
Camel jetty Security Information SECURITY
http://www.securityfocus.com/archive/1/537147/100/0/threaded
Camel jetty Security Information SECURITY
http://www.securityfocus.com/bid/80696

Frequently Asked Questions

What is CVE-2015-5348?
CVE-2015-5348 is a security vulnerability in Camel jetty involving Apache Camel can allow remote attackers to execute arbitrary commands under General Security Weakness.
Which Camel jetty versions are affected?
Affected versions include releases prior to 2.15.5, 2.16.1 across affected packages: org.apache.camel:camel-jetty, org.apache.camel:camel-servlet, org.apache.camel:camel-http, org.apache.camel:camel-http-common, org.apache.camel:camel-http4, org.apache.camel:camel-ahc.
What version fixes CVE-2015-5348?
Upgrading to 2.15.5, 2.16.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is camel-jetty affected?
Yes, org.apache.camel:camel-jetty is affected in releases prior to 2.15.5, 2.16.1. Upgrade your dependency to 2.15.5, 2.16.1 or later.
Is camel-servlet affected?
Yes, org.apache.camel:camel-servlet is affected in releases prior to 2.15.5, 2.16.1. Upgrade your dependency to 2.15.5, 2.16.1 or later.
What is the CVSS score of CVE-2015-5348?
CVE-2015-5348 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2015-5348?
CVE-2015-5348 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2015-5348?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.camel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-26v6-w6fw-rh94",
  "modified" : "2023-12-19T22:56:00Z",
  "published" : "2018-10-16T23:12:20Z",
  "aliases" : [ "CVE-2015-5348" ],
  "summary" : "Apache Camel can allow remote attackers to execute arbitrary commands",
  "details" : "Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jetty"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jetty"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-servlet"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-servlet"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-http4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-ahc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-ahc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.16.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ],
    "versions" : [ "2.16.0" ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2015-5348"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/f7f0b18f6924fe0b01f32a25ed1e38e29b1bf8e5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/e7fd5f049c2fd51a528f8062da91a1c75e33b0e8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/d853853469292cd54fd9662c3605030ab5a9566b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/c558f30a6d3820faa3d8c4ad5e54448914ec60d0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/c47cffcadabca0c588753555a386942184a33627"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/a68434c258cdcd30587ae7adc5dabbac43eadbbf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/9cbd5867fe73ef07ecba6f16d64689632e3f2a16"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/94330f99acb6f28155793b253de9956c3798f3bb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/92081b203523c5ed502ed41df43cbd8655caf9b9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/7e28d0af471ea992eb74807a4abd1626b88d678a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/735ee02c693964b5f700af13a2adfeae56b848a4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/5ea0a6f6c6a54f1cddf9691a99b0c237afc95348"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/515c822148d52de9e7cdf4f6b01f7b793f2f273f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/4f065fe07c1dcd7b451e6005a6dc8e96d77da43e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/44e6a3036e5a11d90b60c142cf51ed74b792de31"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/349109b0834764560f0be69eb74f43a16bd220b0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/32eacdaff16f8709da55e27b83fa21a16d739f63"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/1b1ccbcd94860f6f1d8caf98fb59e6ab7b3940b4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/190d7c81b7e3ce767514e319630b1bbaf27e6817"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/13e43c1412ad72d99030b4eb4cb72c84fa57d5ff"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/0afcf721ff209eb10a24c5e4b48ca9d6727ea99a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel"
  }, {
    "type" : "WEB",
    "url" : "https://issues.apache.org/jira/browse/CAMEL-9309"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-26v6-w6fw-rh94"
  }, {
    "type" : "WEB",
    "url" : "http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/537147/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/80696"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-16T20:51:34Z",
    "nvd_published_at" : null
  }
}