Threats tagged 'ghsa-5rc6-9qfp-8vwg'

The Apache Camel Consul component contains a deserialization vulnerability in the ConsulRegistry class, where untrusted Java-serialized data from the Consul KV store is deserialized without proper filtering. This allows an attacker with write access to the Consul KV store to inject malicious serialized objects, potentially leading to arbitrary code execution within the Camel process. The vulnerability affects Apache Camel versions from 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1. Fixed versions include 4.14.6, 4.18.1, and later 4.19.0. Users are advised to upgrade to these versions to mitigate the risk.