This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit c74b8995d1bd831eb54214f0749fefd164da17d4 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 10:36:38 2026 +0200 Added CVE-2026-95664 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-95664.md | 25 +++++++++++++++++++++ content/security/CVE-2026-95664.txt.asc | 39 +++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/content/security/CVE-2026-95664.md b/content/security/CVE-2026-95664.md new file mode 100644 index 00000000..af01e39d --- /dev/null +++ b/content/security/CVE-2026-95664.md @@ -0,0 +1,25 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-95664" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95664.html +draft: false +type: security-advisory +cve: CVE-2026-95664 +severity: MEDIUM +summary: "Camel-AWS2-S3: The producer evaluated an object key taken from the CamelAwsS3Key header as a Simple expression, so a route forwarding objects between buckets evaluated object names chosen by anyone able to upload to the source bucket" +description: "For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3Utils.determineKey() also passed the resulting value to the Simple language whenever it contained ${ or $simple{, so that a route could use a dynamic key, and the evaluation applied to a value taken from the header as well as to the confi [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.8.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. After upgrading, a key or bucket [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24901 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26746 (commit 1fd7a667913ad068c8571b39c96b0a9c2dd4f3ef), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26840 (commit 19a672aa791480bff6b61c0551c79b2fa079da6e) and to camel-4.18.x in https://github.com/apache/camel/pull/26842 (commit 124bf3da3cfb5d8e1994471e1301b6421bfe96d2). Two follow-up documentation changes on main added the upgrade-guide entries for the 4.22.x and 4.18.x release lines, in http [...] + +AWS2S3Utils.determineKey() and determineBucketName() now evaluate the Simple language only for the keyName and bucketName options configured on the endpoint, which the route author writes. A key supplied through the CamelAwsS3Key header, or a bucket name supplied through the CamelAwsS3OverrideBucketName header, is used literally, so a forwarding route now writes an object whose name contains ${ under exactly that name. Configured dynamic keys and bucket names are unchanged. This changes [...] + +The evaluation has been present since 4.8.0, when https://issues.apache.org/jira/browse/CAMEL-20971 added dynamic key and bucket names to the producer, and it applied to the header value from that release on, so every release from 4.8.0 up to the fixed versions carries the issue. Of the release lines involved, only 4.18.x and 4.22.x are still supported. Before 4.10.0 the producer read an overriding bucket name from the CamelAwsS3BucketName header, which the consumer sets to the bucket co [...] + +This issue belongs to the same family as CVE-2026-78164, where the HTTP producers resolved property placeholders in message-supplied URI override headers, and CVE-2026-83531, where the dynamic-router-control endpoint compiled predicate expressions supplied by control messages: in each case the framework evaluated a value that arrived with the message instead of treating it as data. It is distinct from the Camel header-injection advisories such as CVE-2025-27636, which concern consumers t [...] diff --git a/content/security/CVE-2026-95664.txt.asc b/content/security/CVE-2026-95664.txt.asc new file mode 100644 index 00000000..44d3ac5a --- /dev/null +++ b/content/security/CVE-2026-95664.txt.asc @@ -0,0 +1,39 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-95664" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95664.html +draft: false +type: security-advisory +cve: CVE-2026-95664 +severity: MEDIUM +summary: "Camel-AWS2-S3: The producer evaluated an object key taken from the CamelAwsS3Key header as a Simple expression, so a route forwarding objects between buckets evaluated object names chosen by anyone able to upload to the source bucket" +description: "For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3Utils.determineKey() also passed the resulting value to the Simple language whenever it contained ${ or $simple{, so that a route could use a dynamic key, and the evaluation applied to a value taken from the header as well as to the confi [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.8.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. After upgrading, a key or bucket [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24901 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26746 (commit 1fd7a667913ad068c8571b39c96b0a9c2dd4f3ef), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26840 (commit 19a672aa791480bff6b61c0551c79b2fa079da6e) and to camel-4.18.x in https://github.com/apache/camel/pull/26842 (commit 124bf3da3cfb5d8e1994471e1301b6421bfe96d2). Two follow-up documentation changes on main added the upgrade-guide entries for the 4.22.x and 4.18.x release lines, in http [...] + +AWS2S3Utils.determineKey() and determineBucketName() now evaluate the Simple language only for the keyName and bucketName options configured on the endpoint, which the route author writes. A key supplied through the CamelAwsS3Key header, or a bucket name supplied through the CamelAwsS3OverrideBucketName header, is used literally, so a forwarding route now writes an object whose name contains ${ under exactly that name. Configured dynamic keys and bucket names are unchanged. This changes [...] + +The evaluation has been present since 4.8.0, when https://issues.apache.org/jira/browse/CAMEL-20971 added dynamic key and bucket names to the producer, and it applied to the header value from that release on, so every release from 4.8.0 up to the fixed versions carries the issue. Of the release lines involved, only 4.18.x and 4.22.x are still supported. Before 4.10.0 the producer read an overriding bucket name from the CamelAwsS3BucketName header, which the consumer sets to the bucket co [...] + +This issue belongs to the same family as CVE-2026-78164, where the HTTP producers resolved property placeholders in message-supplied URI override headers, and CVE-2026-83531, where the dynamic-router-control endpoint compiled predicate expressions supplied by control messages: in each case the framework evaluated a value that arrived with the message instead of treating it as data. It is distinct from the Camel header-injection advisories such as CVE-2025-27636, which concern consumers t [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ +QQChZAf/bxgTVVooyQkQoSD1dnfWT6+grYTeGxT0BLRUaVOYnqRL67aeHJ1k/t6q +cqVP4k/bFtQOP9TdMLxMxciwD1cyi4Ba7IKqra+VA2gSt46DFb7Qr4tvyxOVd9Lr +wO2BMRmQwuduACGif1gPjlRQxK5acl+gyP3jVm/cqNRB5qVEnw/2FKOFb+ea1tDY +oYydamxE8lJFvnxvogEKjdoqzfziQ+Sl7aN2vH6pLO/eBdWbxdcHCGERfVLWPbVh +1wtikbmgeHrtKW212kHevKt2+tzEgvyNAtihK8uUJxpCMpY1YIXEFlN0gMnZK0cQ +IZvWBYUuk9DCo2B/0EmdBBBv9qlCuA== +=ST/7 +-----END PGP SIGNATURE-----
