This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 0fb704a5878fafdca73b4448f1586f3429836f39 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Jun 15 12:27:06 2026 +0200 Added CVE-2026-46590 Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-46590.md | 17 +++++++++++++++++ content/security/CVE-2026-46590.txt.asc | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/content/security/CVE-2026-46590.md b/content/security/CVE-2026-46590.md new file mode 100644 index 00000000..9351633a --- /dev/null +++ b/content/security/CVE-2026-46590.md @@ -0,0 +1,17 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-46590" +date: 2026-06-10T10:00:00+02:00 +url: /security/CVE-2026-46590.html +draft: false +type: security-advisory +cve: CVE-2026-46590 +severity: MEDIUM +summary: "Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)" +description: "The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObje [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any d [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.18.3 and 4.21.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23726 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23912 (commit feea08e7847f35dc0e177652b0b02bd45f6c1b4f) and backported to camel-4.18.x in https://github.com/apache/camel/pull/23914 (commit 12a9ac3c94d6fda12d16b2c0039db41c6204727e). The fix introduces a shared KeyMetadataCodec that stores key metadata as JSON for all three KeyL [...] diff --git a/content/security/CVE-2026-46590.txt.asc b/content/security/CVE-2026-46590.txt.asc new file mode 100644 index 00000000..6840499a --- /dev/null +++ b/content/security/CVE-2026-46590.txt.asc @@ -0,0 +1,31 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-46590" +date: 2026-06-10T10:00:00+02:00 +url: /security/CVE-2026-46590.html +draft: false +type: security-advisory +cve: CVE-2026-46590 +severity: MEDIUM +summary: "Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)" +description: "The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObje [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any d [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.18.3 and 4.21.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23726 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23912 (commit feea08e7847f35dc0e177652b0b02bd45f6c1b4f) and backported to camel-4.18.x in https://github.com/apache/camel/pull/23914 (commit 12a9ac3c94d6fda12d16b2c0039db41c6204727e). The fix introduces a shared KeyMetadataCodec that stores key metadata as JSON for all three KeyL [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovx0kACgkQ406fOAL/ +QQD+sAf+L/iA+rSluo6rIJ6RqqWIsOUDKQzDB6XIdWO9WZRoYEuKfZXrUF42pxJS +WtvDxUDmrf5yTl5T89cVhyE+3QnLV09qgC3A2W8YT5LBh8P7ishODUbaxgi7oY4T +CB9lXZ/dkMpn/D7uCSmbZW8r6WcNTczJwNd4j77d4yv3S8eEv0/xBkCqQon8xBo+ +q8a7E2fu1ghYP+P6ZayGU2Ir6eDfRjOx/eFMDpj7fIPGxa5CN3dA75n+yT2R5GCp +d0kuf0ET2cLA0XdA/iY1pIQFw+QflukJGK43z6zyOHR0YSXlBLeCqUo7HWQIxT89 +NfFGcwhw/urpfth1d50gh9MfIgdW+A== +=gCER +-----END PGP SIGNATURE-----
