This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit a08d01ef6ce300a982b5460e22ecf17909135c70 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:40 2026 +0200 Added CVE-2026-80344 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-80344.md | 21 ++++++++++++++++++++ content/security/CVE-2026-80344.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-80344.md b/content/security/CVE-2026-80344.md new file mode 100644 index 00000000..a6978d9b --- /dev/null +++ b/content/security/CVE-2026-80344.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-80344" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80344.html +draft: false +type: security-advisory +cve: CVE-2026-80344 +severity: HIGH +summary: "Camel-AS2: server-side request forgery and credential disclosure - the asynchronous MDN delivery address supplied by the remote partner was used as the destination for the receipt, so the sender chose where the Camel instance would connect and what credentials it would present" +description: "In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach cred [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24417 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25637 (commit ff2b608d77ba773b030fe80467e77cf28ae209d4), backported to camel-4.22.x in https://github.com/apache/camel/pull/25763 (commit af7421ff5f7456e252dad14e3279c7809cdef208) and to camel-4.18.x in https://github.com/apache/camel/pull/25764 (commit 64459b6299c07364eb9a225ee02fa2153da526e2). + +The issue is classified as CWE-918 Server-Side Request Forgery (SSRF). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-80344.txt.asc b/content/security/CVE-2026-80344.txt.asc new file mode 100644 index 00000000..0f40523a --- /dev/null +++ b/content/security/CVE-2026-80344.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-80344" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80344.html +draft: false +type: security-advisory +cve: CVE-2026-80344 +severity: HIGH +summary: "Camel-AS2: server-side request forgery and credential disclosure - the asynchronous MDN delivery address supplied by the remote partner was used as the destination for the receipt, so the sender chose where the Camel instance would connect and what credentials it would present" +description: "In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach cred [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24417 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25637 (commit ff2b608d77ba773b030fe80467e77cf28ae209d4), backported to camel-4.22.x in https://github.com/apache/camel/pull/25763 (commit af7421ff5f7456e252dad14e3279c7809cdef208) and to camel-4.18.x in https://github.com/apache/camel/pull/25764 (commit 64459b6299c07364eb9a225ee02fa2153da526e2). + +The issue is classified as CWE-918 Server-Side Request Forgery (SSRF). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrQACgkQ406fOAL/ +QQBuDQf/RASTmy7khWoz0M/3QFTcas76FV/38xvwVnR7wEPswF8pXmS7khJ4MUPh +oY1T93YR1kJUkCfhhocZfN5JoEjUye4VeSSQzPdYQo8a4J0qbDef7EOfyuUo5/pK +AagJE/5mTz7NvM2Q0WQomi4TAfmc3xbULjDEOJZM2SKu7tNrNAcOfYMGf9GC3ezE +hkdkbcyqgw64Wa2umtqOFGSc+imU9rDxcirZHYepBs4WOxqApwRheJSRZegZW0Y+ +hWzU5YB9kxiXwLxltB+8gd5ppPTvlkETpWXhURE1376aL5dtALPxNkCOnjRUGCpZ +uOCX82XUnB3VrG4GehJo+hnbk/r1VQ== +=E8HC +-----END PGP SIGNATURE-----
