{"url":"http://public2.vulnerablecode.io/api/packages/401373?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.10.4","type":"maven","namespace":"org.apache.camel","name":"camel-jackson","version":"2.10.4","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2.16.5","latest_non_vulnerable_version":"2.18.2","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/116188?format=json","vulnerability_id":"VCID-pu26-4ct2-afch","summary":"Remote Code Execution attacks\nThis package is vulnerable to Java object de-serialization vulnerability. Camel allows to specify such a type through the `CamelJacksonUnmarshalType` property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.","references":[{"reference_url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc","reference_id":"CVE-2016-8749.TXT.ASC","reference_type":"","scores":[],"url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc"},{"reference_url":"http://www.cvedetails.com/cve/CVE-2016-9571/","reference_id":"CVE-2016-9571","reference_type":"","scores":[],"url":"http://www.cvedetails.com/cve/CVE-2016-9571/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/81783?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.16.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.16.5"},{"url":"http://public2.vulnerablecode.io/api/packages/81785?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.17.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.17.5"},{"url":"http://public2.vulnerablecode.io/api/packages/81789?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.18.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.18.2"}],"aliases":["CVE-2016-9571"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pu26-4ct2-afch"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.10.4"}