This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 4737685f9010e816edf89acf71a153f7643c7c91 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Jun 15 12:27:06 2026 +0200 Added CVE-2026-46456 Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-46456.md | 17 +++++++++++++++++ content/security/CVE-2026-46456.txt.asc | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/content/security/CVE-2026-46456.md b/content/security/CVE-2026-46456.md new file mode 100644 index 00000000..4aefe784 --- /dev/null +++ b/content/security/CVE-2026-46456.md @@ -0,0 +1,17 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-46456" +date: 2026-06-10T10:00:00+02:00 +url: /security/CVE-2026-46456.html +draft: false +type: security-advisory +cve: CVE-2026-46456 +severity: MEDIUM +summary: "Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers" +description: "The camel-aws2-sqs component maps inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not configure an inbound filter. As a result, when Sqs2Consumer copies each SQS MessageAttribute into the Exchange via HeaderFilterStrategy.applyFilterToExter [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix adds an inbound HeaderFilterStrategy rule to Sqs2HeaderFilterStrategy that filters the Camel header namespace case-insensitively on inbound mapping, so sender-supplied Camel* / camel* headers are no longer copied [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23506 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23221 (commit 5f57258fb33d33ef99df10594f8fe9f11d7c2b7e) and backported to camel-4.18.x (commit 7b334be0419839097a132d4ff3427fc4083e695e) and camel-4.14.x (commit b7f78292e747a28dbf5da444265557b5f9f3c1a1). The issue is classified as CWE-20 (Improper Input Validation). It belongs t [...] diff --git a/content/security/CVE-2026-46456.txt.asc b/content/security/CVE-2026-46456.txt.asc new file mode 100644 index 00000000..6b395a44 --- /dev/null +++ b/content/security/CVE-2026-46456.txt.asc @@ -0,0 +1,31 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-46456" +date: 2026-06-10T10:00:00+02:00 +url: /security/CVE-2026-46456.html +draft: false +type: security-advisory +cve: CVE-2026-46456 +severity: MEDIUM +summary: "Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers" +description: "The camel-aws2-sqs component maps inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not configure an inbound filter. As a result, when Sqs2Consumer copies each SQS MessageAttribute into the Exchange via HeaderFilterStrategy.applyFilterToExter [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix adds an inbound HeaderFilterStrategy rule to Sqs2HeaderFilterStrategy that filters the Camel header namespace case-insensitively on inbound mapping, so sender-supplied Camel* / camel* headers are no longer copied [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23506 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23221 (commit 5f57258fb33d33ef99df10594f8fe9f11d7c2b7e) and backported to camel-4.18.x (commit 7b334be0419839097a132d4ff3427fc4083e695e) and camel-4.14.x (commit b7f78292e747a28dbf5da444265557b5f9f3c1a1). The issue is classified as CWE-20 (Improper Input Validation). It belongs t [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovx0QACgkQ406fOAL/ +QQBxdwf/UgsFkSaK6vTC9glRWLySFdR725HGT1GtGPb/zkpbAVATc3xPwd+sy7ca +8ZwQOFUj/XkpBS1+i92HqTejbXaGD0zs0MDYJeDd6RgWUmTa/W1ibk/NpY3bOLiQ +V5VOdNQTIn8lF+gKYVTuVtlTRUkMZjiwEZCroG5kZcnyBL40JxdaH8PObPFTM+vp +dSB6LOMd40Bl6pLj5ocvoZ1ipPqZEIb000r6H6eBVLC/MrByXIlCcHQ9Q5IGqkWX +7ui30RQG/QnGKuZGFXTts6o0fil5vDfKrdYV9UCOIGTSWrxxiT56T/JsiHN0LOVb +yaDWfQQcbZnf6f4lsXHUU1TUNIGUTA== +=U/lk +-----END PGP SIGNATURE-----
