This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit d0a71578be81a1590efcc9b7d94ad3a657bb3791 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:41 2026 +0200 Added CVE-2026-84178 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-84178.md | 21 ++++++++++++++++++++ content/security/CVE-2026-84178.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-84178.md b/content/security/CVE-2026-84178.md new file mode 100644 index 00000000..03885a46 --- /dev/null +++ b/content/security/CVE-2026-84178.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-84178" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84178.html +draft: false +type: security-advisory +cve: CVE-2026-84178 +severity: MEDIUM +summary: "Camel-OAuth: login cross-site request forgery - the authorization code callback was not bound to the flow that started it, so a code obtained in any browser could be redeemed at the callback and bound to whichever session presented it" +description: "The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization code obtained in any browser could therefore be redeemed at the callback and associated with whichever session presented it, which is login cross-site request forgery: a victim can be silently signed in as an identity the attacker controls, so that actions the victim then performs, and data they [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The authorization request now issues a state value bound to the session, and the callback rejects a request whose state is absent or does not match, stopping the route with a 400 response. For deployments that cannot upgrade immediately, terminate the authorization code flow in a component t [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24437 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25821 (commit 495c5ad39a0f95f823da512b38da5c19609e2a1c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25944 (commit 95b4c1500001bc32877df5b8fca0bc7bdd080666) and to camel-4.18.x in https://github.com/apache/camel/pull/25946 (commit 4ec9b37d70b08c478966000fb1bd653abfe410e3). + +The issue is classified as CWE-352 Cross-Site Request Forgery (CSRF). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-84178.txt.asc b/content/security/CVE-2026-84178.txt.asc new file mode 100644 index 00000000..238e2864 --- /dev/null +++ b/content/security/CVE-2026-84178.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-84178" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84178.html +draft: false +type: security-advisory +cve: CVE-2026-84178 +severity: MEDIUM +summary: "Camel-OAuth: login cross-site request forgery - the authorization code callback was not bound to the flow that started it, so a code obtained in any browser could be redeemed at the callback and bound to whichever session presented it" +description: "The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization code obtained in any browser could therefore be redeemed at the callback and associated with whichever session presented it, which is login cross-site request forgery: a victim can be silently signed in as an identity the attacker controls, so that actions the victim then performs, and data they [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The authorization request now issues a state value bound to the session, and the callback rejects a request whose state is absent or does not match, stopping the route with a 400 response. For deployments that cannot upgrade immediately, terminate the authorization code flow in a component t [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24437 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25821 (commit 495c5ad39a0f95f823da512b38da5c19609e2a1c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25944 (commit 95b4c1500001bc32877df5b8fca0bc7bdd080666) and to camel-4.18.x in https://github.com/apache/camel/pull/25946 (commit 4ec9b37d70b08c478966000fb1bd653abfe410e3). + +The issue is classified as CWE-352 Cross-Site Request Forgery (CSRF). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrUACgkQ406fOAL/ +QQCO0wgAhlVdRyxEeGcW+av3qSLV/b6WLk3DFz+HYlf9DRG5+DltMHjS4VEXErX1 +4593H8kLeA2kOq9eSjOv9EKxuxifrWyMGDU66LeWQz2K06zF7gp2GwyWdXocZBks +sckbOGYAdoG2O+SSaendJ2l0PcO0SfhAAqZ3ixI33v2BrouHtyvqeAjgjhvO3dja +YilKXvhOWhDxX+XxP923l5fmGDRtAqIdoiKtnuh7sjWTNPoWKLWWekVsAN2CPKzT +k+0yDRN+oNPGu+wXNcjK1zc/+/f1b3vo1wSKYNoxZeoOFc3mrv0PDiV//gjF4EmH +dTwmreNvTVwkio8yvbukpV01KlYjEw== +=uyRW +-----END PGP SIGNATURE-----
