This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 567fb9c6d78c8ddc13286e02d897ac063ea0ef5e Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:40 2026 +0200 Added CVE-2026-80343 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-80343.md | 21 ++++++++++++++++++++ content/security/CVE-2026-80343.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-80343.md b/content/security/CVE-2026-80343.md new file mode 100644 index 00000000..dbd7a919 --- /dev/null +++ b/content/security/CVE-2026-80343.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-80343" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80343.html +draft: false +type: security-advisory +cve: CVE-2026-80343 +severity: HIGH +summary: "Camel-Netty-HTTP: security constraint bypass - the security constraint matched the request path case sensitively while dispatch to the route did not, so altering the case of a path segment skipped the constraint and still reached the endpoint" +description: "The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the requ [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24412 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25578 (commit 9c18465443a0df60179e6abf96f7794983cd0637), backported to camel-4.22.x in https://github.com/apache/camel/pull/25761 (commit ccd49cc5049113c8be976ecef3d581da112b9918) and to camel-4.18.x in https://github.com/apache/camel/pull/25762 (commit 1d280e815f350bbeb8888150cfb5a3d8eca3c7b9). + +The issue is classified as CWE-178 Improper Handling of Case Sensitivity. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-80343.txt.asc b/content/security/CVE-2026-80343.txt.asc new file mode 100644 index 00000000..9cd52089 --- /dev/null +++ b/content/security/CVE-2026-80343.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-80343" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-80343.html +draft: false +type: security-advisory +cve: CVE-2026-80343 +severity: HIGH +summary: "Camel-Netty-HTTP: security constraint bypass - the security constraint matched the request path case sensitively while dispatch to the route did not, so altering the case of a path segment skipped the constraint and still reached the endpoint" +description: "The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the requ [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24412 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25578 (commit 9c18465443a0df60179e6abf96f7794983cd0637), backported to camel-4.22.x in https://github.com/apache/camel/pull/25761 (commit ccd49cc5049113c8be976ecef3d581da112b9918) and to camel-4.18.x in https://github.com/apache/camel/pull/25762 (commit 1d280e815f350bbeb8888150cfb5a3d8eca3c7b9). + +The issue is classified as CWE-178 Improper Handling of Case Sensitivity. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrQACgkQ406fOAL/ +QQDv/wf/ZO9jiSzWcy8VKAc6zkYs2OZANZFaSloosplcP/iMBHW3WGb4Vj020jnA +rxuqOv39R9nQIe1gn3z5WARSJNOIp4EsPhjveKPMQOo24LLiw6gwLI7zAfAziLJQ +1ii+O6FL5pMaXyFkIUUHE9eJC7XxdaZQEDm+7G/few67ipTBPGYkAG0z4I39smDN +HE6WZH+7U2YbXrF3fV+BG1JUAEMYgkE16eI6AKpX8EeGFkHYvw4fOeZdB7xVXT2N +FFuiZBqGUwlp++vl0WsRjFTUzYKa/wgBfDFbbkCKoJSZfjmkoGTFbe4uA8DiYfPE +DhPVPH4AuGDx0E5kBqdpwJ9M1+Cifg== +=MZr1 +-----END PGP SIGNATURE-----
