This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 057aa1be41efcacdbd0427afa0c6f85aa0d1499f Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 14:20:55 2026 +0200 Correct CVE-2026-90885 and re-sign it Drop the claim that camel-xslt-saxon already applies secure processing by default. It does not hold on every line the advisory covers, so the page now only says the fix aligns a Source body with the parser configuration XmlConverter applies to the other body types. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-90885.md | 2 +- content/security/CVE-2026-90885.txt.asc | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/security/CVE-2026-90885.md b/content/security/CVE-2026-90885.md index dc195594..65ca531b 100644 --- a/content/security/CVE-2026-90885.md +++ b/content/security/CVE-2026-90885.md @@ -18,7 +18,7 @@ The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24691 refers to the The fix was merged on main in https://github.com/apache/camel/pull/26344 (commit 9c23b6868bb92cb19c2b5a7ee624421d760cda8f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26728 (commit 0d0ed8bbe38fdae6e778c4f719e80c2e2d0e51b2) and to camel-4.18.x in https://github.com/apache/camel/pull/26730 (commit ed513f3a7117c3343a9e31e22e5627498f2fcdb6). -XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies, and with camel-xslt-saxon, which already applies secure processing by default. The change is visible [...] +XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies. The change is visible and is recorded in the 4.23 upgrade guide: a body that reaches XQuery as an alr [...] The code path predates Apache Camel 4.0 and was already present in the 2.x and 3.x releases, so the affected range starts at 4.0.0 and every release line up to the fixed releases carries the issue. The 4.14.x line and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x lines, reached end of life before the fix and do not receive it. On the 4.22.x line the fix was backported after 4.22.1 had been cut, so 4.22.1 is affected and 4.22.2 is the first fixed release of that line. diff --git a/content/security/CVE-2026-90885.txt.asc b/content/security/CVE-2026-90885.txt.asc index aa72caa5..bf4c22ea 100644 --- a/content/security/CVE-2026-90885.txt.asc +++ b/content/security/CVE-2026-90885.txt.asc @@ -21,19 +21,19 @@ The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24691 refers to the The fix was merged on main in https://github.com/apache/camel/pull/26344 (commit 9c23b6868bb92cb19c2b5a7ee624421d760cda8f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26728 (commit 0d0ed8bbe38fdae6e778c4f719e80c2e2d0e51b2) and to camel-4.18.x in https://github.com/apache/camel/pull/26730 (commit ed513f3a7117c3343a9e31e22e5627498f2fcdb6). -XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies, and with camel-xslt-saxon, which already applies secure processing by default. The change is visible [...] +XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies. The change is visible and is recorded in the 4.23 upgrade guide: a body that reaches XQuery as an alr [...] The code path predates Apache Camel 4.0 and was already present in the 2.x and 3.x releases, so the affected range starts at 4.0.0 and every release line up to the fixed releases carries the issue. The 4.14.x line and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x lines, reached end of life before the fix and do not receive it. On the 4.22.x line the fix was backported after 4.22.1 had been cut, so 4.22.1 is affected and 4.22.2 is the first fixed release of that line. This issue is distinct from CVE-2026-85250, which concerned the documentType=InputSource option of camel-xpath and was fixed in 4.18.5, 4.22.1 and 4.23.0. Both concerned an input path that bypassed the parser hardening applied by default, but they are in different components and the fix for one does not cover the other; in particular, 4.22.1 resolves CVE-2026-85250 but not this issue. It is classified as CWE-611 (Improper Restriction of XML External Entity Reference). -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQDH2AgAnOvWFBfccoiiYTB859+8ICI4FhFbkaCwUv+jsNJ6dP+5nlkPj9ACPZud -i7NqUbdO45e6m8eETehxU8FFVUOHNfzK5ktPRCmauZ7MavpEnCVcextcw+NYp7fV -X7teEKbIc6Wdj8ZRM1vGhHDC0QsMIi7zTfVloI7qMYfXkS6Y6/vP57r35wIU6VtY -OjrBAajXbCvvO1Cb/fG10q4MEKAtAzI8h6VzkBZo11TJclOlQdvImMlkT5QGJOp4 -Br+TDDJ+9DdKGtAHJAhlWvh+FCDPA5Jet2JyKZ8j02c6licT61p5FF3nRtx9K3tF -zQP6Py1DSYalPddrtUyPkoLgFucE/Q== -=za0T +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrWCw0ACgkQ406fOAL/ +QQDSCgf+P42OTo1YfJ/L7z+StZYYIPeaKvBNTI56kbcggjiVgm9G1gTR8NgbiSs3 +K8V5Vv1l+Q9MECgLZt6kpjMXK/3kukJrfRoJDMiMzVRqK7QI4WzbJv8tZEO4sIuu +D6wWz/0vCg65CHogKL5WCx7Zk26OjzncTixdwU36Uj1bIIJijtbtbpWlRI574N3Z +SoA6bHz8FpHh7B/GZLFuYNE0SSdm+LbN/jRRMqz4A1ntEShk5HuxZJ4Jwxg+tHz8 +iRT9jfFhPavpP3d4pEbQt6OjuG/qtC81DGabOYichZyu4If/YJ4SjtFj5J4H/nHp +ctTMTG2FPlpvU/Ahjl32VFd2Nko1Cw== +=f9WN -----END PGP SIGNATURE-----
