Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 30 Jan 2016 08:27:10 +0100
From: Claus Ibsen <>
To: "" <>, dev <>,,, 
	security <>
Subject: CVE-2015-5344 - Apache Camel medium disclosure vulnerability

Apache Camel's XStream usage is vulnerable to Remote Code Execution attacks

Apache Camel's camel-xstream component is vulnerable to Java object
de-serialisation vulnerability.
Such as de-serializing untrusted data can lead to security flaws as
demonstrated in various similar reports about Java de-serialization

Please study this security vulnerability carefully!
CVE-2015-5344 - [1]

You can download the fixed Apache Camel 2.15.x and 2.16.x version from
the Apache mirrors [2] or from the Central Maven repository.


On behalf of the Camel PMC,
Claus Ibsen

Claus Ibsen
----------------- @davsclaus
Camel in Action 2:

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ