{"url":"http://public2.vulnerablecode.io/api/packages/412942?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.7.1","type":"maven","namespace":"org.apache.camel","name":"camel-jackson","version":"2.7.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2.16.5","latest_non_vulnerable_version":"2.18.2","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/362012?format=json","vulnerability_id":"VCID-tdkc-ve6m-s3fa","summary":"Remote Code Execution attacks\nThis package is vulnerable to Java object de-serialization vulnerability. Camel allows to specify such a type through the `CamelJacksonUnmarshalType` property. De-serializing untrusted data can lead to security flaws as demonstrated in various similar reports about Java de-serialization issues.","references":[{"reference_url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc","reference_id":"CVE-2016-8749.TXT.ASC","reference_type":"","scores":[],"url":"http://camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc"},{"reference_url":"http://www.cvedetails.com/cve/CVE-2016-9571/","reference_id":"CVE-2016-9571","reference_type":"","scores":[],"url":"http://www.cvedetails.com/cve/CVE-2016-9571/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14055?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.16.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.16.5"},{"url":"http://public2.vulnerablecode.io/api/packages/14052?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.17.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.17.5"},{"url":"http://public2.vulnerablecode.io/api/packages/14054?format=json","purl":"pkg:maven/org.apache.camel/camel-jackson@2.18.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.18.2"}],"aliases":["CVE-2016-9571"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tdkc-ve6m-s3fa"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.camel/camel-jackson@2.7.1"}