This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit b99ae12fc9441cb9deae28fccf360f8a39317f77 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Aug 24 11:45:03 2026 +0200 Added CVE-2026-71300 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-71300.md | 21 ++++++++++++++++++++ content/security/CVE-2026-71300.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-71300.md b/content/security/CVE-2026-71300.md new file mode 100644 index 00000000..b50d8e33 --- /dev/null +++ b/content/security/CVE-2026-71300.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-71300" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-71300.html +draft: false +type: security-advisory +cve: CVE-2026-71300 +severity: MEDIUM +summary: "Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace, so an external sender could take over the dispatch decision" +description: "The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through Exchange headers, and the string values of those headers sat outside the Camel namespace: websocket.connectionKey and websocket.connectionKey.list, along with websocket.sendToAll, websocket.eventType and websocket.errorType. WebsocketEndpoint extends ServletEndpoint and so inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes; the do [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, strip the dispatch headers at the trust boundary before the producer, for example with removeHeaders(\"websocket.*\") placed between the HTTP consumer and the atmosphere-w [...] +credit: "This issue was discovered by Barak Srour from Apiiro" +affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24359 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25366 (commit 60ca704c0379e6e87107158c0b2174c3f0f2f48a) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25382 (commit 66567833fb1efe6d66c6618dbb48295cce4c84ba) and to camel-4.14.x in https://github.com/apache/camel/pull/25383 (commit 49e197a66158eb7151b461b46b37407df2e13591). A follow-up documentation change, https://github.com/apache/camel/pull/25384 (commit b6532db34afe185d85fd14daf27f2a460018b078 [...] + +The fix renames the five Exchange header string values from the legacy dotted websocket. prefix to the project-wide convention documented in design/headers.adoc, so that websocket.connectionKey becomes CamelAtmosphereWebsocketConnectionKey and the remaining four follow the same form. The Java field names in WebsocketConstants are unchanged, so code referring to the constants symbolically continues to work; only code using the literal strings must be updated. The remedy is a rename rather [...] diff --git a/content/security/CVE-2026-71300.txt.asc b/content/security/CVE-2026-71300.txt.asc new file mode 100644 index 00000000..0c5fbcd5 --- /dev/null +++ b/content/security/CVE-2026-71300.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-71300" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-71300.html +draft: false +type: security-advisory +cve: CVE-2026-71300 +severity: MEDIUM +summary: "Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace, so an external sender could take over the dispatch decision" +description: "The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through Exchange headers, and the string values of those headers sat outside the Camel namespace: websocket.connectionKey and websocket.connectionKey.list, along with websocket.sendToAll, websocket.eventType and websocket.errorType. WebsocketEndpoint extends ServletEndpoint and so inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes; the do [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, strip the dispatch headers at the trust boundary before the producer, for example with removeHeaders(\"websocket.*\") placed between the HTTP consumer and the atmosphere-w [...] +credit: "This issue was discovered by Barak Srour from Apiiro" +affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0." +fixed: 4.14.9, 4.18.4 and 4.22.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24359 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25366 (commit 60ca704c0379e6e87107158c0b2174c3f0f2f48a) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25382 (commit 66567833fb1efe6d66c6618dbb48295cce4c84ba) and to camel-4.14.x in https://github.com/apache/camel/pull/25383 (commit 49e197a66158eb7151b461b46b37407df2e13591). A follow-up documentation change, https://github.com/apache/camel/pull/25384 (commit b6532db34afe185d85fd14daf27f2a460018b078 [...] + +The fix renames the five Exchange header string values from the legacy dotted websocket. prefix to the project-wide convention documented in design/headers.adoc, so that websocket.connectionKey becomes CamelAtmosphereWebsocketConnectionKey and the remaining four follow the same form. The Java field names in WebsocketConstants are unchanged, so code referring to the constants symbolically continues to work; only code using the literal strings must be updated. The remedy is a rename rather [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqMEpYACgkQ406fOAL/ +QQDh9ggAscpPSIc1e4WafQjXY8AyLRjYdFL3V5TNltu71DL4upB3L/et0ONfZTm8 +Y+U+jW5Lmc/FjeGg5Tkd8t0o5MJP1E2TaH+d707hBKWK9R1GXnf+VWfLZHbizJDv ++xSCJmAd0CCuUcrSxhvHjboqRUOGrBNH6eRLOfbFarHT5aHoETYyY+MpqU9OtDAi +MOX9PXak0QHfwMoIdsNwAXO7UmXm9ts0VGkx1eDgNvXimSc8Ru05Cf0oJ8+Pd24J +4FOoKaADa7yxYnUtotx3uOMsz5B5P0L7WpjCjLJeMPAm5OdSUvszaeDrksqckPgb +EmmINe8ow+bXJLA8aI+irKdp599a1w== +=MIxn +-----END PGP SIGNATURE-----
