This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit a15d8e1c3ea96069f83908ff5caab334855c5e45 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:42 2026 +0200 Added CVE-2026-85313 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85313.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85313.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85313.md b/content/security/CVE-2026-85313.md new file mode 100644 index 00000000..929323af --- /dev/null +++ b/content/security/CVE-2026-85313.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85313" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85313.html +draft: false +type: security-advisory +cve: CVE-2026-85313 +severity: MEDIUM +summary: "Camel-Jetty: cross-origin credential exposure - setting enableCORS installed Jetty's CrossOriginFilter with its allow-all defaults, so every origin was accepted and credentials were granted to all of them" +description: "Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the pl [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relyi [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24450 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25829 (commit 6e3e4ec510b4966c70ad99b3c032e27d6adbef9d), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85313.txt.asc b/content/security/CVE-2026-85313.txt.asc new file mode 100644 index 00000000..ccae2cb1 --- /dev/null +++ b/content/security/CVE-2026-85313.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85313" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85313.html +draft: false +type: security-advisory +cve: CVE-2026-85313 +severity: MEDIUM +summary: "Camel-Jetty: cross-origin credential exposure - setting enableCORS installed Jetty's CrossOriginFilter with its allow-all defaults, so every origin was accepted and credentials were granted to all of them" +description: "Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the pl [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relyi [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24450 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25829 (commit 6e3e4ec510b4966c70ad99b3c032e27d6adbef9d), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrYACgkQ406fOAL/ +QQAKKQf8CJ56f9Uf5VEWRrYJawLwdaEQ/bsODok6pPBneSxXAvE+dFbJM2MW37SF +lTTUnC5147hs73whxbysK7NeqQD2wpWuLmngPF4OZMEjiJJV5JPCO5CnPezBh1rl +sGfOIUNA7roQovpSrbPqgHCdYCFvUi8SIDEFDi1ob/e4QIC/O0OQ0sMkyLJH1Gsh +/AfFTsQlG1W1ayct8OiMwP4w9SwTAY31gFnzoHcRMNNh1hEKw4vzx2MltHoEiThj +sCjcgXUdU29ZTpPkYzLA0SAau2rVZQ3jbIImDHA6O4xZTKM92UNjMRS8TP232vCo +yLgAdKfcTKIwu10RMNbB3T0ncDJTZQ== +=7d5V +-----END PGP SIGNATURE-----
