Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the `FileBasedKeyLifecycleManager` class while handling contents of `<keyId>.key` files. An attacker can execute arbitrary code by placing a crafted serialized Java object in the key directory, which is then deserialized during normal key lifecycle operations. This can be achieved through methods such as path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack. How to fix Deserialization of Untrusted Data? Upgrade `org.apache.camel:camel-pqc` to version 4.18.2, 4.20.0 or higher.	[4.18.0,4.18.2)[4.19.0,4.20.0)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the FileBasedKeyLifecycleManager class while handling contents of <keyId>.key files. An attacker can execute arbitrary code by placing a crafted serialized Java object in the key directory, which is then deserialized during normal key lifecycle operations. This can be achieved through methods such as path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack.

How to fix Deserialization of Untrusted Data?

Upgrade org.apache.camel:camel-pqc to version 4.18.2, 4.20.0 or higher.

[4.18.0,4.18.2)[4.19.0,4.20.0)

Go back to all versions of this package