This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 055a69d23df2175a5ad1c57198c30b7102ace154 Author: Andrea Cosentino <[email protected]> AuthorDate: Tue Oct 13 13:23:19 2026 +0200 Added CVE-2026-91858 Co-Authored-By: Claude Opus 4.8 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-91858.md | 23 ++++++++++++++++++++ content/security/CVE-2026-91858.txt.asc | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/content/security/CVE-2026-91858.md b/content/security/CVE-2026-91858.md new file mode 100644 index 00000000..1249940a --- /dev/null +++ b/content/security/CVE-2026-91858.md @@ -0,0 +1,23 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-91858" +date: 2026-10-13T10:00:00+02:00 +url: /security/CVE-2026-91858.html +draft: false +type: security-advisory +cve: CVE-2026-91858 +severity: MEDIUM +summary: "Camel-FOP: XML external entity processing - FopProducer created a TransformerFactory with only secure processing enabled, so when a third-party JAXP TransformerFactory such as Saxon-HE was on the classpath, an external DTD or entity declared in the XSL-FO input was resolved and expanded" +description: "FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, the same configuration Camel's XmlConverter applies, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attribute [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24605 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26108 (commit 209c67a851d3c145583d25829b7ffac0c500674b), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26168 (commit f689a9c92f0e6c406f9a0256c7d940024cf56782) and to camel-4.18.x in https://github.com/apache/camel/pull/26169 (commit 9c06c6d265d70be30023e7514456b697e91db69e). + +FopProducer now configures the TransformerFactory it creates with XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET set to the empty string, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and elsewhere in the codebase. External DTD and external stylesheet access is therefore refused on any JAXP TransformerFactory implementation that honours those attributes, includi [...] + +The issue is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-91858.txt.asc b/content/security/CVE-2026-91858.txt.asc new file mode 100644 index 00000000..127e266b --- /dev/null +++ b/content/security/CVE-2026-91858.txt.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-91858" +date: 2026-10-13T10:00:00+02:00 +url: /security/CVE-2026-91858.html +draft: false +type: security-advisory +cve: CVE-2026-91858 +severity: MEDIUM +summary: "Camel-FOP: XML external entity processing - FopProducer created a TransformerFactory with only secure processing enabled, so when a third-party JAXP TransformerFactory such as Saxon-HE was on the classpath, an external DTD or entity declared in the XSL-FO input was resolved and expanded" +description: "FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, the same configuration Camel's XmlConverter applies, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attribute [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24605 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26108 (commit 209c67a851d3c145583d25829b7ffac0c500674b), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26168 (commit f689a9c92f0e6c406f9a0256c7d940024cf56782) and to camel-4.18.x in https://github.com/apache/camel/pull/26169 (commit 9c06c6d265d70be30023e7514456b697e91db69e). + +FopProducer now configures the TransformerFactory it creates with XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET set to the empty string, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and elsewhere in the codebase. External DTD and external stylesheet access is therefore refused on any JAXP TransformerFactory implementation that honours those attributes, includi [...] + +The issue is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrOFGYACgkQ406fOAL/ +QQDTDQgAvDLVd81XFUEeMVrjEgMVmQRpKUuikMpTWF44mcuEV6YqLV9r/duD5GNV +7RRfLIbLjbpOtoJwW1UnOD0I9aZ90K2mecbluQyOiOt7hIgqT+CdQA6gWLpsgqYy +J2eplJoKszyUAoc1PPETnfreb3XGWAWOt4NGi44YmXt8fxT3CkfWUmV5akLSBu/O +ncw3Z9cXngSsjyq32cGpCkMk31xj11fJyaEfrG1F4vkmjD9IiNbiM7/qPu8Ph7uE +qul2jFp9GjsnBzBnKjGk1Di+/zX6h5VWLfqX7Lps7XJQ6ktY2ZDnWHmcYTPGqOGW +ZWIRgfa0BskHqjTjVcApSQntlXdfHw== +=0mlW +-----END PGP SIGNATURE-----
