description: The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
problem types: Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks
affected:
{
product: Apache Camel
vendor: Apache Software Foundation
versions:
status: affected, version: 2.19.0 to 2.19.3
status: affected, version: 2.20.0
status: affected, version: The unsupported Camel 2.x (2.18 and earlier) versions may be also affected.
}