oscerd opened a new pull request, #1805: URL: https://github.com/apache/camel-website/pull/1805
Adds the two security advisory pages for Apache Camel Karavan, both fixed in Karavan 4.22.1. | CVE | Issue | Severity | Fix | | --- | --- | --- | --- | | CVE-2026-103412 | Project file names escaped the project directory when a project was written to the working copy for a Git commit (CWE-22) | HIGH | [`5e425249`](https://github.com/apache/camel-karavan/commit/5e4252494817af0cd2697216bd02f361037fedcf) | | CVE-2026-103413 | A project's `kubernetes.yaml` was applied with no restriction on resource kinds, no rejection of host-level pod options and no namespace pinning (CWE-20) | HIGH | [`a773db37`](https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571) | Both reports came in on 2026-08-28 via the ASF Security team and were accepted by the Karavan maintainers the same day. CVE ids were reserved on 2026-09-30. Karavan has no maintenance branches, so each advisory states a single affected range closing at 4.22.1 rather than the per-branch ranges used for Camel core advisories, and 4.22.1 is named as the only release carrying the fix. Each `.md` ships with its matching clearsigned `.txt.asc`, as with the existing advisories. Note that this branch is intended to be released ahead of the other pending advisory branches. The CVE 5.1 records are submitted separately through CVE Services. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01LhQkuMMro7EkXxjU8XYryx -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
