This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch CVE-more-sessions in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 6fecdb004da6117fa263d2e69a4d05b2c6e3595f Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Aug 24 10:21:05 2026 +0200 Added CVE-2026-63621 Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-63621.md | 21 ++++++++++++++++++++ content/security/CVE-2026-63621.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-63621.md b/content/security/CVE-2026-63621.md new file mode 100644 index 00000000..75f84e56 --- /dev/null +++ b/content/security/CVE-2026-63621.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-63621" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-63621.html +draft: false +type: security-advisory +cve: CVE-2026-63621 +severity: MEDIUM +summary: "Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy, so an untrusted sender could inject Camel-internal headers" +description: "The camel-knative consumer accepts CloudEvents in two content modes. In binary mode the event attributes arrive as HTTP headers, and KnativeHttpConsumer maps them onto the message through a HeaderFilterStrategy, so Camel-internal headers are not propagated. In structured content mode, selected by the Content-Type application/cloudevents+json, the whole event is a JSON document in the request body: AbstractCloudEventProcessor parses that body and CloudEventProcessors then ma [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. The fix landed on the maintenance lines and on main only; the non-LTS 4.15.x, 4.16.x, 4.17.x, 4.19.x, 4.20.x and 4.21.x releases are affected and are no longer maintained, so users on those lines should move to 4.18.4 or [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 3.15.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24084 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/24724 (commit bbf680af8af4a39f808727758e72d469c2eec539) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24753 (commit 5c7a8dbf1f1ed92bb4f289a50cc1765095054112) and to camel-4.14.x in https://github.com/apache/camel/pull/24751 (commit 4eb26807d40420abf45253286ce3d07c2fba448c). A follow-up documentation change, https://github.com/apache/camel/pull/24768 (commit 7a46dbbca88fba647c89da86ed172251c4622fc3 [...] + +The fix gives AbstractCloudEventProcessor a HeaderFilterStrategy and a shared mapExtensionAsHeader helper, and routes the structured-mode extension mapping for all supported CloudEvents spec versions through that helper, so the same filtering is applied on both content modes and Camel-internal header names are matched case-insensitively. Ordinary CloudEvent extension attributes are unaffected and continue to be propagated. The strategy is obtained differently per branch: on main the comp [...] diff --git a/content/security/CVE-2026-63621.txt.asc b/content/security/CVE-2026-63621.txt.asc new file mode 100644 index 00000000..812cbb6e --- /dev/null +++ b/content/security/CVE-2026-63621.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-63621" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-63621.html +draft: false +type: security-advisory +cve: CVE-2026-63621 +severity: MEDIUM +summary: "Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy, so an untrusted sender could inject Camel-internal headers" +description: "The camel-knative consumer accepts CloudEvents in two content modes. In binary mode the event attributes arrive as HTTP headers, and KnativeHttpConsumer maps them onto the message through a HeaderFilterStrategy, so Camel-internal headers are not propagated. In structured content mode, selected by the Content-Type application/cloudevents+json, the whole event is a JSON document in the request body: AbstractCloudEventProcessor parses that body and CloudEventProcessors then ma [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. The fix landed on the maintenance lines and on main only; the non-LTS 4.15.x, 4.16.x, 4.17.x, 4.19.x, 4.20.x and 4.21.x releases are affected and are no longer maintained, so users on those lines should move to 4.18.4 or [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 3.15.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24084 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/24724 (commit bbf680af8af4a39f808727758e72d469c2eec539) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24753 (commit 5c7a8dbf1f1ed92bb4f289a50cc1765095054112) and to camel-4.14.x in https://github.com/apache/camel/pull/24751 (commit 4eb26807d40420abf45253286ce3d07c2fba448c). A follow-up documentation change, https://github.com/apache/camel/pull/24768 (commit 7a46dbbca88fba647c89da86ed172251c4622fc3 [...] + +The fix gives AbstractCloudEventProcessor a HeaderFilterStrategy and a shared mapExtensionAsHeader helper, and routes the structured-mode extension mapping for all supported CloudEvents spec versions through that helper, so the same filtering is applied on both content modes and Camel-internal header names are matched case-insensitively. Ordinary CloudEvent extension attributes are unaffected and continue to be propagated. The strategy is obtained differently per branch: on main the comp [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL+3oACgkQ406fOAL/ +QQBzXAf/SfzEZSI5aK0KE2Glrci9IxoqSywNWS/GO/0nB8uMraxGIL9qpzLeEVDk +9/F4uKBPIGi3VaGcaqC+CHvluN0ANsYt3C5PHMRRo2+44fhPRDRwzjvRL921+kZh +R4waSZTzrZWlj8TJ8XX2lUSwEhg71M9n+f6zfAYZi4o+HGqHykmfwXDbOpO7eBeh +yfb7vr1Ku6z/75xAo71qWQ5x23aKZ0eqY5eLjFbRH0xCOur6zs6ZF7LlJxa337OF +f3zb91fyyB3AP9mnyUyTB8r4CBZpLbucq+nWWb9IiLPzrnJ7QC0iJbqBK4fi7X6m +CSFxz8Rzf7StvL2YPGEdoOk5PjslMw== +=T9l9 +-----END PGP SIGNATURE-----
