Vulnerabilities in pkg:maven/org.apache.camel/camel-jackson

Q: What is CVE-2016-8749?

CVE-2016-8749 is a security vulnerability in Camel jackson involving Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks under CWE-502: Deserialization of Untrusted Data.

Q: Which Camel jackson versions are affected?

Affected versions include releases prior to 2.16.5, 2.17.5, 2.18.2 across affected packages: org.apache.camel:camel-jackson.

Q: What version fixes CVE-2016-8749?

Upgrading to 2.16.5, 2.17.5, 2.18.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is camel-jackson affected?

Yes, org.apache.camel:camel-jackson is affected in releases prior to 2.16.5, 2.17.5, 2.18.2. Upgrade your dependency to 2.16.5, 2.17.5, 2.18.2 or later.

Q: What is the CVSS score of CVE-2016-8749?

CVE-2016-8749 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2016-8749?

CVE-2016-8749 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).

Q: How can I check Maven dependencies for CVE-2016-8749?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.camel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-vvjc-q5vr-52q6

Advisory Summary

CVE-2016-8749 is a CRITICAL (CVSS 9.8) remote code execution vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Camel jackson libraries in the Maven ecosystem. The issue involves apache camel's jackson and jacksonxml unmarshalling operation are vulnerable to remote code execution attacks. Remediation is available by upgrading affected packages to version 2.16.5, 2.17.5, 2.18.2.

1 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:maven/org.apache.camel/camel-jackson

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.apache.camel/camel-jackson. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-vvjc-q5vr-52q6	CVE-2016-8749	CRITICAL	Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks

CVE-2016-8749 at a Glance

CVE Identifier CVE-2016-8749

GHSA Identifier GHSA-vvjc-q5vr-52q6

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-502: Deserialization of Untrusted Data

Affected Product Camel jackson

Package Ecosystem Maven

Published Date 2018-10-16

Last Updated 2023-12-19

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2016-8749

To remediate this vulnerability, upgrade all affected Camel jackson dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.camel:camel-jackson fixed: 2.16.5

<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jackson</artifactId>
    <version>2.16.5</version>
</dependency>

org.apache.camel:camel-jackson fixed: 2.17.5

<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jackson</artifactId>
    <version>2.17.5</version>
</dependency>

org.apache.camel:camel-jackson fixed: 2.18.2

<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-jackson</artifactId>
    <version>2.18.2</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=org.apache.camel

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2016-8749, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.camel

Analyze the terminal output to locate any version of Camel jackson in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.16.5), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.camel command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Camel jackson, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues. Mitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should upgrade to 2.18.2. The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604 refers to the various commits that resovoled the issue, and have more details.

CVE-2016-8749 Affected Camel jackson Versions

3 component(s)

Fixed Versions:

2.16.52.17.52.18.2

Product / Package	Ecosystem	Affected Versions	Fixed Version
org.apache.camel:camel-jackson maven/org.apache.camel/camel-jackson	Maven	< 2.16.5	2.16.5
org.apache.camel:camel-jackson maven/org.apache.camel/camel-jackson	Maven	≥ 2.17.0 < 2.17.5	2.17.5
org.apache.camel:camel-jackson maven/org.apache.camel/camel-jackson	Maven	≥ 2.18.0 < 2.18.2	2.18.2

References

NVD — CVE-2016-8749 NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-8749

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7e

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/2b0e96117d6f01eba0c18e2ff8df6a438e819721

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/57d01e2fc8923263df896e9810329ee5b7f9b69e

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/5ae9c0dcc4843347cd01ffb58ce5dd0687755a14

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/7567488f844f01d72840f7ab6ca18114a11f20d8

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/83fef7108456eeac1506853d194cd1360851c4fe

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/881e5099f94316d4a66ffbff0a3e6915829d49d7

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/8c862aa11e31d0f804c4a4516a0715e05e3eebcf

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/abb45b2c2ada2bbb34138230540b37d259c1e98d

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/ccf149c76bf37adc5977dc626e141a14e60b5aee

Security Fix Commit FIX COMMIT

https://github.com/apache/camel/commit/d4102512147eca2af21c3b6ed63a67d852f4e66a

issues.apache.org/jira/browse/camel-1... WEB

https://issues.apache.org/jira/browse/CAMEL-10604

lists.apache.org/thread.html/2318d7f... WEB

https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E

lists.apache.org/thread.html/b4014ea... WEB

https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E

Camel jackson Source Repository REPOSITORY

https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

issues.apache.org/jira/browse/camel-1... WEB

https://issues.apache.org/jira/browse/CAMEL-10567

Camel jackson Source Repository REPOSITORY

https://github.com/apache/camel

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-vvjc-q5vr-52q6

access.redhat.com/errata/rhsa-2017:18... WEB

https://access.redhat.com/errata/RHSA-2017:1832

Camel jackson Security Information SECURITY

http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2

Camel jackson Security Information SECURITY

http://www.openwall.com/lists/oss-security/2017/05/22/2

Camel jackson Security Information SECURITY

http://www.securityfocus.com/bid/97179

Frequently Asked Questions

What is CVE-2016-8749?

CVE-2016-8749 is a security vulnerability in Camel jackson involving Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks under CWE-502: Deserialization of Untrusted Data.

Which Camel jackson versions are affected?

Affected versions include releases prior to 2.16.5, 2.17.5, 2.18.2 across affected packages: org.apache.camel:camel-jackson.

What version fixes CVE-2016-8749?

Upgrading to 2.16.5, 2.17.5, 2.18.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Is camel-jackson affected?

Yes, org.apache.camel:camel-jackson is affected in releases prior to 2.16.5, 2.17.5, 2.18.2. Upgrade your dependency to 2.16.5, 2.17.5, 2.18.2 or later.

What is the CVSS score of CVE-2016-8749?

CVE-2016-8749 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2016-8749?

CVE-2016-8749 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).

How can I check Maven dependencies for CVE-2016-8749?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.camel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vvjc-q5vr-52q6",
  "modified" : "2023-12-19T23:04:54Z",
  "published" : "2018-10-16T23:13:00Z",
  "aliases" : [ "CVE-2016-8749" ],
  "summary" : "Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks",
  "details" : "Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object\nde-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType'\nproperty. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.\n\nMitigation: 2.16.x users should upgrade to 2.16.5, 2.17.x users should upgrade to 2.17.5, 2.18.x users should\nupgrade to 2.18.2. \n\nThe JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-10567 and https://issues.apache.org/jira/browse/CAMEL-10604\nrefers to the various commits that resovoled the issue, and have more details.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jackson"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.16.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jackson"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.17.0"
      }, {
        "fixed" : "2.17.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.camel:camel-jackson"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.18.0"
      }, {
        "fixed" : "2.18.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-8749"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/10f552643d7e4565104d142bbc160db5a30f9f7e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/235036d2396ae45b6809b72a1983dee33b5ba326"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/2b0e96117d6f01eba0c18e2ff8df6a438e819721"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/57d01e2fc8923263df896e9810329ee5b7f9b69e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/5ae9c0dcc4843347cd01ffb58ce5dd0687755a14"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/7567488f844f01d72840f7ab6ca18114a11f20d8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/83fef7108456eeac1506853d194cd1360851c4fe"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/881e5099f94316d4a66ffbff0a3e6915829d49d7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/8c862aa11e31d0f804c4a4516a0715e05e3eebcf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/abb45b2c2ada2bbb34138230540b37d259c1e98d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/ccf149c76bf37adc5977dc626e141a14e60b5aee"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/camel/commit/d4102512147eca2af21c3b6ed63a67d852f4e66a"
  }, {
    "type" : "WEB",
    "url" : "https://issues.apache.org/jira/browse/CAMEL-10604"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true"
  }, {
    "type" : "WEB",
    "url" : "https://issues.apache.org/jira/browse/CAMEL-10567"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/camel"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-vvjc-q5vr-52q6"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2017:1832"
  }, {
    "type" : "WEB",
    "url" : "http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc?version=2&modificationDate=1486565034000&api=v2"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2017/05/22/2"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/97179"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-502" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-16T21:58:26Z",
    "nvd_published_at" : null
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-vvjc-q5vr-52q6
Schema Version: 1.4.0
Published: 2018-10-16 23:13
Last Modified: 2023-12-19 23:04
Database Record File: advisories/github-reviewed/2018/10/GHSA-vvjc-q5vr-52q6/GHSA-vvjc-q5vr-52q6.json