This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit a9c2d6991274fffe03f5f4624e2131490a6ae269 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Sep 7 12:58:15 2026 +0200 Added CVE-2026-78165 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01QxisTvLYJ34tTmymqQDEQG Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-78165.md | 23 ++++++++++++++++++++ content/security/CVE-2026-78165.txt.asc | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/content/security/CVE-2026-78165.md b/content/security/CVE-2026-78165.md new file mode 100644 index 00000000..092e331f --- /dev/null +++ b/content/security/CVE-2026-78165.md @@ -0,0 +1,23 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-78165" +date: 2026-09-07T10:00:00+02:00 +url: /security/CVE-2026-78165.html +draft: false +type: security-advisory +cve: CVE-2026-78165 +severity: HIGH +summary: "Camel-Spring-Redis: The default JdkSerializationRedisSerializer deserializes Redis payloads with no ObjectInputFilter, allowing an actor who can publish to the subscribed channel to achieve remote code execution" +description: "RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject m [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24421 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25587 (commit 8db602a5ee105403fa40c1b821157c8d9d0c1977), and backported to camel-4.22.x in https://github.com/apache/camel/pull/25588 (commit b2ba1ed90562e10e07bfb4a3cab60b817885e6de) and to camel-4.18.x in https://github.com/apache/camel/pull/25589 (commit e721141ddcaeb9a08892730942b1b362c2da1c5c). A follow-up documentation change, https://github.com/apache/camel/pull/25734 (commit ddc7885a7add93326b3d549c565c43bbccad12d [...] + +A new deserializationFilter endpoint option, labelled advanced and security, now controls the filter applied while the default serializer reads Redis payloads. When it is not set, the JVM-wide jdk.serialFilter is honoured if present, and otherwise a conservative default allow-list is applied that permits standard Java and Apache Camel types and denies java.net. On the 4.23.0 and 4.22.1 releases the default is resolved through the shared DeserializationFilterHelper and additionally enforc [...] + +This is a change of default behaviour for routes that exchange classes outside the allow-list, which must widen it through the new option; the change is documented in the upgrade guides for each affected release line. The issue is classified as CWE-502 (Deserialization of Untrusted Data) and belongs to the same family as the unfiltered Java deserialization advisories published previously for other Camel components. diff --git a/content/security/CVE-2026-78165.txt.asc b/content/security/CVE-2026-78165.txt.asc new file mode 100644 index 00000000..12d99173 --- /dev/null +++ b/content/security/CVE-2026-78165.txt.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-78165" +date: 2026-09-07T10:00:00+02:00 +url: /security/CVE-2026-78165.html +draft: false +type: security-advisory +cve: CVE-2026-78165 +severity: HIGH +summary: "Camel-Spring-Redis: The default JdkSerializationRedisSerializer deserializes Redis payloads with no ObjectInputFilter, allowing an actor who can publish to the subscribed channel to achieve remote code execution" +description: "RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject m [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24421 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25587 (commit 8db602a5ee105403fa40c1b821157c8d9d0c1977), and backported to camel-4.22.x in https://github.com/apache/camel/pull/25588 (commit b2ba1ed90562e10e07bfb4a3cab60b817885e6de) and to camel-4.18.x in https://github.com/apache/camel/pull/25589 (commit e721141ddcaeb9a08892730942b1b362c2da1c5c). A follow-up documentation change, https://github.com/apache/camel/pull/25734 (commit ddc7885a7add93326b3d549c565c43bbccad12d [...] + +A new deserializationFilter endpoint option, labelled advanced and security, now controls the filter applied while the default serializer reads Redis payloads. When it is not set, the JVM-wide jdk.serialFilter is honoured if present, and otherwise a conservative default allow-list is applied that permits standard Java and Apache Camel types and denies java.net. On the 4.23.0 and 4.22.1 releases the default is resolved through the shared DeserializationFilterHelper and additionally enforc [...] + +This is a change of default behaviour for routes that exchange classes outside the allow-list, which must widen it through the new option; the change is documented in the upgrade guides for each affected release line. The issue is classified as CWE-502 (Deserialization of Untrusted Data) and belongs to the same family as the unfiltered Java deserialization advisories published previously for other Camel components. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqemI8ACgkQ406fOAL/ +QQCTYQgApRXx1DYaQxDgYkK6HEpEsc+OHURPvR+WMhggkLuIy/MP7vnoWuvojMIX +KUsqpUIvlNx84lTJMhiiQefQML7rcBRDskHoxSsFyd11X9f/i+WVQWuFJUgUA6mB +zbJbQDYftbrWYM3ajaToqKDti0iu/5uapM1ywzit5TtaGbczegSBYPnGoI0/cgk2 +jo1kW8tRHHpc95pLO81jM3nlTSCDzoLK4PzMSxck3hijh97f+RBPEIIPQTyrR58z +QuSMgtNYlamELjU9BzIqXMJPC7Dx2uUqVVhF3cSk8kfVCPRzB7Ia36vyELl+Z+3K +zcgaXJrs5DDnWR4ijaLGieqSR1Imzg== +=UqHS +-----END PGP SIGNATURE-----
