This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 730e260c98aa7571a753bd4b29f13d98b3343416 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:41 2026 +0200 Added CVE-2026-85248 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85248.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85248.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85248.md b/content/security/CVE-2026-85248.md new file mode 100644 index 00000000..d2430e45 --- /dev/null +++ b/content/security/CVE-2026-85248.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85248" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85248.html +draft: false +type: security-advisory +cve: CVE-2026-85248 +severity: MEDIUM +summary: "Camel-PQC: signature verification bypass - one java.security.Signature instance was shared across concurrent exchanges without synchronization, so interleaved use could make a verification succeed for data it never covered" +description: "The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once." +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24445 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25825 (commit 91d5bdac51182fda8515e5b200e8aa842ccd1bc6), backported to camel-4.22.x in https://github.com/apache/camel/pull/25850 (commit 936a851a2b92c29712a77080fa0935b361179f83) and to camel-4.18.x in https://github.com/apache/camel/pull/25851 (commit 1466b0fdf5a6e9a8fd859893f9b245218f30ea17). + +The issue is classified as CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85248.txt.asc b/content/security/CVE-2026-85248.txt.asc new file mode 100644 index 00000000..72debb6b --- /dev/null +++ b/content/security/CVE-2026-85248.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85248" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85248.html +draft: false +type: security-advisory +cve: CVE-2026-85248 +severity: MEDIUM +summary: "Camel-PQC: signature verification bypass - one java.security.Signature instance was shared across concurrent exchanges without synchronization, so interleaved use could make a verification succeed for data it never covered" +description: "The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once." +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24445 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25825 (commit 91d5bdac51182fda8515e5b200e8aa842ccd1bc6), backported to camel-4.22.x in https://github.com/apache/camel/pull/25850 (commit 936a851a2b92c29712a77080fa0935b361179f83) and to camel-4.18.x in https://github.com/apache/camel/pull/25851 (commit 1466b0fdf5a6e9a8fd859893f9b245218f30ea17). + +The issue is classified as CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrUACgkQ406fOAL/ +QQCdzAf+Lyi9wwU5TfyAVvVIq8LQvXxGNJRNUP7KRWi2aqH/j+5UmlFmD68H8b/9 +XRVYsdLc/TVBb31EAjmsFRCkjpVkhlrnWIzLBKLwk84oLyJTGAqNg9VHlR+E5pvZ +JC1svboYhDQyoZJqchHkm+BSMh5vSnHFkdtmgZeryM3Kpszy9tadm94nx3MdmFAB +OJ4vvqDLRAtPpNoESvNyTouUBnjP8/1ZJq5NgGRaY62XtwIfN13pX8+WH+PCh9u3 +qNYMXC/+xoNpuiwq0zCX2ZckD4//k/xF6yIHwzc09baT+sGW0nuCqmztMvWdQoEJ +od67VovRGPMc9RgZcobHNmxOLikERQ== +=aHdz +-----END PGP SIGNATURE-----
