CVE-2020-11973

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	Apache Camel	Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0

References

http://www.openwall.com/lists/oss-security/2020/05/14/9Mailing List, Third Party Advisory
https://camel.apache.org/security/CVE-2020-11973.htmlVendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/05/14/9Mailing List, Third Party Advisory
https://camel.apache.org/security/CVE-2020-11973.htmlVendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory

Timeline

Published: May 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119749.8In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.CVE-2020-119759.8Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execut CVE-2020-119767.5By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sen CVE-2020-119777.2In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use CVE-2020-119788.8An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the CVE-2020-119797.5As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was al CVE-2020-11987.4<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web req CVE-2020-119806.3In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually CVE-2020-119819.8An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis,CVE-2020-119829.8An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, R CVE-2020-119835.4An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC CVE-2020-119849.8Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE