jbonofre opened a new pull request, #723: URL: https://github.com/apache/camel-karaf/pull/723
Backport of #717 to the `camel-karaf-4.18.x` branch. ## What Upgrades the bundled **Apache CXF** from `4.1.5` to `4.1.7`. Closes #712 for 4.18.x. ## Why CXF `< 4.1.6` is affected by [CVE-2026-44417](https://nvd.nist.gov/vuln/detail/CVE-2026-44417) — an incomplete fix of CVE-2025-48913, allowing remote code execution when an untrusted party can influence the JMS configuration (CWE-20). It is fixed upstream in CXF **4.1.6 / 4.2.1 / 3.6.11**. `4.1.7` is the latest `4.1.x` patch: it carries the CVE fix plus subsequent `4.1.x` fixes and stays within the existing OSGi import range `[4.1,4.2)`, so no other feature/import changes are required. Per the camel-karaf security model, the vulnerability lives in **Apache CXF** (a packaged component); camel-karaf's role here is solely the bundled-version upgrade. ## Changes - `pom.xml`: `cxf-version` `4.1.5` → `4.1.7`, and `cxf-codegen-plugin-version` moved in lockstep. The `cxf-xjc-*` plugins are a separately versioned artifact family and are left unchanged. The `camel-cxf-all` bundle shades every `org.apache.cxf:*` artifact via `${cxf-version}`, so the rebuilt bundle embeds and re-exports CXF `4.1.7`. ## Notes CVE-2026-44417 is already public and fixed upstream, and issue #712 is public — so this is a normal public dependency-bump backport (no embargo). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
