This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 5e9e10fc26fc3d371e692324473cf327b4382865 Author: Andrea Cosentino <[email protected]> AuthorDate: Wed Oct 14 10:41:32 2026 +0200 Added CVE-2026-88901 Co-Authored-By: Claude Opus 4.8 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-88901.md | 23 ++++++++++++++++++++ content/security/CVE-2026-88901.txt.asc | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/content/security/CVE-2026-88901.md b/content/security/CVE-2026-88901.md new file mode 100644 index 00000000..45907f8d --- /dev/null +++ b/content/security/CVE-2026-88901.md @@ -0,0 +1,23 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-88901" +date: 2026-10-14T10:00:00+02:00 +url: /security/CVE-2026-88901.html +draft: false +type: security-advisory +cve: CVE-2026-88901 +severity: HIGH +summary: "Camel-Smooks: XML external entity processing - the Smooks data format and component parsed the incoming XML message body with the reader Smooks resolves by default, which resolves external general and parameter entities and loads external DTDs, so an external entity declared in that body could read local files or reach internal hosts" +description: "Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.conve [...] +credit: "This issue was reported by h1ei1" +affected: "From 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24677 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26270 (commit 4b1fc499a0ceff909612b5310152cd71517888f7), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26327 (commit 1b375c171e2546cafdcaadc2aa9f7346a25a4cd7) and to camel-4.18.x in https://github.com/apache/camel/pull/26329 (commit 680290f6ba5324301673b7353564130af6d2ad83). + +camel-smooks now parses untrusted XML with a javax.xml.parsers.DocumentBuilder configured with FEATURE_SECURE_PROCESSING and with external general entities, external parameter entities and external DTD loading disabled, and hands Smooks the resulting DOM, rather than letting Smooks parse the body with its default Woodstox reader. Because the reader Smooks uses is shared across every source type, reconfiguring it would also break the non-XML readers used for marshalling and for EDI, CSV a [...] + +The issue is classified as CWE-611 (Improper Restriction of XML External Entity Reference). diff --git a/content/security/CVE-2026-88901.txt.asc b/content/security/CVE-2026-88901.txt.asc new file mode 100644 index 00000000..a3cf0b97 --- /dev/null +++ b/content/security/CVE-2026-88901.txt.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-88901" +date: 2026-10-14T10:00:00+02:00 +url: /security/CVE-2026-88901.html +draft: false +type: security-advisory +cve: CVE-2026-88901 +severity: HIGH +summary: "Camel-Smooks: XML external entity processing - the Smooks data format and component parsed the incoming XML message body with the reader Smooks resolves by default, which resolves external general and parameter entities and loads external DTDs, so an external entity declared in that body could read local files or reach internal hosts" +description: "Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.conve [...] +credit: "This issue was reported by h1ei1" +affected: "From 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24677 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26270 (commit 4b1fc499a0ceff909612b5310152cd71517888f7), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26327 (commit 1b375c171e2546cafdcaadc2aa9f7346a25a4cd7) and to camel-4.18.x in https://github.com/apache/camel/pull/26329 (commit 680290f6ba5324301673b7353564130af6d2ad83). + +camel-smooks now parses untrusted XML with a javax.xml.parsers.DocumentBuilder configured with FEATURE_SECURE_PROCESSING and with external general entities, external parameter entities and external DTD loading disabled, and hands Smooks the resulting DOM, rather than letting Smooks parse the body with its default Woodstox reader. Because the reader Smooks uses is shared across every source type, reconfiguring it would also break the non-XML readers used for marshalling and for EDI, CSV a [...] + +The issue is classified as CWE-611 (Improper Restriction of XML External Entity Reference). +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrPQtMACgkQ406fOAL/ +QQBD5Qf6A2XHACiefSRV2h5hDf5Jg97kcLq1DLRUVcRnGjh8UOOztKdWGCfIdqYB +flSsTa/Q/jIGThkVB9T/11V2eK3rb7I5IXlFO7Uu5+YNY+PJtEvB9JZAMpNWnXHI +lP0Eh0OR0Oh2np/d7AUP9Fkyjk/8s3/GTS4WCDk2hAMvy1DrcgdBZmlsjtWJ2VMl +fDB0bwCO+Io5TbNv7pndKXvbj/B+Sz0VH+JA/WVz0q/CWx1IykfFYyCGBhnjaGp2 +jLDWnfhnq6j3rVRgg1bc4Asz6f7fhQC8BySKvzdHPpOZEqRiSRPuFLp9FS02R5xi +1amvl9GlzugsL2beTXwmGPjcN/cjtw== +=iUY8 +-----END PGP SIGNATURE-----
