CVE-2017-3159

Apache Camels camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Potential Mitigations

• Make fields transient to protect them from deserialization.
• An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/586.html

References

• http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1\u0026modificationDate=1486565167000\u0026api=v2
• http://www.openwall.com/lists/oss-security/2017/05/22/2
• http://www.securityfocus.com/bid/96321
• https://access.redhat.com/errata/RHSA-2017:0868
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
• https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
• http://camel.apache.org/security-advisories.data/CVE-2017-3159.txt.asc?version=1\u0026modificationDate=1486565167000\u0026api=v2
• http://www.openwall.com/lists/oss-security/2017/05/22/2
• http://www.securityfocus.com/bid/96321
• https://access.redhat.com/errata/RHSA-2017:0868
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
• https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true