Apache Camel vulnerabilities

The camel-mina component in Apache Camel lacks deserialization filters for IoBuffer, allowing an attacker to achieve remote code execution by sending a crafted Java object to a MINA consumer.

The Camel-PQC FileBasedKeyLifecycleManager class deserializes .key files using java.io.ObjectInputStream without any filters, allowing arbitrary code execution before type checking. An attacker with write access to the key directory can inject a crafted Java object leading to remote code execution.

A deserialization vulnerability in the Apache Camel LevelDB component allows arbitrary code execution. The DefaultLevelDBSerializer class deserializes data without ObjectInputFilter, enabling an attacker with write access to LevelDB files to inject a malicious Java object.

A vulnerability in Apache Camel allows unauthorized exposure of sensitive information. It affects versions from 3.X to 3.14.8, 3.18.X to 3.18.7, 3.20.X to 3.20.5, and 4.X to 4.0.0-M3.