{"url":"http://public2.vulnerablecode.io/api/packages/101097?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.11.3","type":"maven","namespace":"org.apache.camel","name":"camel-jackson","version":"2.11.3","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2.16.5","latest_non_vulnerable_version":"2.18.2","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11304?format=json","vulnerability_id":"VCID-zrpc-e8vn-ekdc","summary":"Remote Code Execution attacks\nThis package is vulnerable to Java object de-serialization vulnerability. Camel allows to specify such a type through the `CamelJacksonUnmarshalType` property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.","references":[{"reference_url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc","reference_id":"CVE-2016-8749.TXT.ASC","reference_type":"","scores":[],"url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc"},{"reference_url":"http://www.cvedetails.com/cve/CVE-2016-9571/","reference_id":"CVE-2016-9571","reference_type":"","scores":[],"url":"http://www.cvedetails.com/cve/CVE-2016-9571/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52310?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.16.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.16.5"},{"url":"http://public2.vulnerablecode.io/api/packages/52311?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.17.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.17.5"},{"url":"http://public2.vulnerablecode.io/api/packages/52312?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.18.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.18.2"}],"aliases":["CVE-2016-9571"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zrpc-e8vn-ekdc"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.11.3"}