This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit f10fc790cd5fb476d863daccd23f1f60d30039ab Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:40 2026 +0200 Added CVE-2026-80312 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-80312.md | 21 ++++++++++++++++++++ content/security/CVE-2026-80312.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-80312.md b/content/security/CVE-2026-80312.md new file mode 100644 index 00000000..eb805c61 --- /dev/null +++ b/content/security/CVE-2026-80312.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-80312" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80312.html +draft: false +type: security-advisory +cve: CVE-2026-80312 +severity: HIGH +summary: "Camel-OAuth: authentication bypass - the OAuth processors returned control to the route instead of stopping it when authentication could not be completed, so a request that failed authentication was processed as if it had succeeded" +description: "The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached what [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization ch [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24411 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25567 (commit a3a98e4c959f3a04d5e5540b60bf2cc36314e37c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25575 (commit 2c61e3387ca8a2b811f96eed0520c78e340c2141) and to camel-4.18.x in https://github.com/apache/camel/pull/25576 (commit 407f2829882475648fe5a575810e171dd0d1391d). + +The issue is classified as CWE-287 Improper Authentication. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-80312.txt.asc b/content/security/CVE-2026-80312.txt.asc new file mode 100644 index 00000000..1b86c099 --- /dev/null +++ b/content/security/CVE-2026-80312.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-80312" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80312.html +draft: false +type: security-advisory +cve: CVE-2026-80312 +severity: HIGH +summary: "Camel-OAuth: authentication bypass - the OAuth processors returned control to the route instead of stopping it when authentication could not be completed, so a request that failed authentication was processed as if it had succeeded" +description: "The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached what [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization ch [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24411 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25567 (commit a3a98e4c959f3a04d5e5540b60bf2cc36314e37c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25575 (commit 2c61e3387ca8a2b811f96eed0520c78e340c2141) and to camel-4.18.x in https://github.com/apache/camel/pull/25576 (commit 407f2829882475648fe5a575810e171dd0d1391d). + +The issue is classified as CWE-287 Improper Authentication. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrQACgkQ406fOAL/ +QQDVDAf+LHyIJenl+BuhdBrWxjx4FbmE7B7qfLjDNVuxcIFD+xOZuhFi/P/3aYcz +wgl7F+PoWWqu0Q3c4fhWfjmQoArPvUoN9eq8ZgR0DcUnpBPrkUSGguDN1sbKrPzL +E3cGDZUMfqszTFZ7eYCt7nTqn9TD0M7D5CUTFjGUELzzp5utXrkEWT3D1g/8dfCw +mj2ubaCTG8u1s26HQafRhMI+qmcaoVKrqsshlIPPGHRhElN785mcADfJk2pPp/rg +8Ssi17Zhq+b2rP4sTaVI2akRIgtMTn4xqKtm3BWY+6GMBvoPT7ddzrVJaYPHIpiF +vQQc626MpX/1I8rPAuIbnTq/w+k8dQ== +=MXgb +-----END PGP SIGNATURE-----
