Threats tagged 'ghsa-4xwx-hvv7-7prj'

The Apache Camel-Infinispan component versions 4.0.0 before 4.14.7, 4.15.0 before 4.18.2, and 4.19.0 before 4.20.0 contain a deserialization vulnerability. This occurs because the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker able to write malicious serialized Java objects to the cache can trigger arbitrary code execution during normal repository operations. The issue is fixed in versions 4.14.7, 4.18.2, and 4.20.0.