This is an automated email from the ASF dual-hosted git repository. davsclaus pushed a commit to branch backport/25622-to-camel-4.22.x in repository https://gitbox.apache.org/repos/asf/camel.git
commit c437e893ec33e47b74ae75e1887d493b43aa1eb8 Author: Ivona Cvija <[email protected]> AuthorDate: Tue Aug 25 08:13:53 2026 +0100 Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 (#25622) apacheds-core-api transitively pulls org.apache.directory.api 2.1.5, which is affected by CVE-2026-35563. ApacheDS is dormant and will not release a fix, but Apache Directory API 2.1.8 remediates it. This excludes org.apache.directory.api from the apacheds-* dependencies (camel-ldif compile scope, camel-ldap test scope) and re-declares the required artifacts at a new central directory-api-version=2.1.8 property, avoiding any 2.1.5/2.1.8 version skew. Closes #25622 --- components/camel-ldap/pom.xml | 52 +++++++++++++++++++++++++++++++++++++++++++ components/camel-ldif/pom.xml | 50 +++++++++++++++++++++++++++++++++++++++++ parent/pom.xml | 1 + 3 files changed, 103 insertions(+) diff --git a/components/camel-ldap/pom.xml b/components/camel-ldap/pom.xml index e2e2e11dffc4..64144fd5ec2f 100644 --- a/components/camel-ldap/pom.xml +++ b/components/camel-ldap/pom.xml @@ -52,6 +52,12 @@ <artifactId>apacheds-server-jndi</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.directory.server</groupId> @@ -63,6 +69,10 @@ <groupId>log4j</groupId> <artifactId>log4j</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> </dependency> <dependency> @@ -70,6 +80,12 @@ <artifactId>apacheds-core-integ</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.mina</groupId> @@ -77,5 +93,41 @@ <version>${mina-version}</version> <scope>test</scope> </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-client-api</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-util</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-codec-standalone</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-sp</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-dsml-engine</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-trigger</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> </dependencies> </project> diff --git a/components/camel-ldif/pom.xml b/components/camel-ldif/pom.xml index 929e239e4e33..6d3116c297a4 100644 --- a/components/camel-ldif/pom.xml +++ b/components/camel-ldif/pom.xml @@ -53,8 +53,48 @@ <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> </dependency> + <!-- Pin org.apache.directory.api transitively brought in by apacheds-core-api + (dormant, no release with the fix) to remediate CVE-2026-35563 --> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-client-api</artifactId> + <version>${directory-api-version}</version> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-util</artifactId> + <version>${directory-api-version}</version> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-codec-standalone</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-sp</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-dsml-engine</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-trigger</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> <!-- test dependencies --> <dependency> @@ -71,6 +111,10 @@ <groupId>log4j</groupId> <artifactId>log4j</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> <scope>test</scope> </dependency> @@ -79,6 +123,12 @@ <artifactId>apacheds-core-integ</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.mina</groupId> diff --git a/parent/pom.xml b/parent/pom.xml index 61eabcdf3aa3..e0045e2e33cc 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -141,6 +141,7 @@ <debezium-mysql-connector-version>26.7.0</debezium-mysql-connector-version> <dhis2-version>3.0.2</dhis2-version> <digitalocean-api-client-version>2.17</digitalocean-api-client-version> + <directory-api-version>2.1.8</directory-api-version> <directory-watcher-version>0.19.1</directory-watcher-version> <disruptor-version>3.4.4</disruptor-version> <dnsjava-version>3.6.5</dnsjava-version>
