This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 310c7e6b6ec1adfe4264a6bae9e90c24b46fc335 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Jun 15 12:27:05 2026 +0200 Added CVE-2026-46453 Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-46453.md | 17 +++++++++++++++++ content/security/CVE-2026-46453.txt.asc | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/content/security/CVE-2026-46453.md b/content/security/CVE-2026-46453.md new file mode 100644 index 00000000..0fc58149 --- /dev/null +++ b/content/security/CVE-2026-46453.md @@ -0,0 +1,17 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-46453" +date: 2026-06-09T10:00:00+02:00 +url: /security/CVE-2026-46453.html +draft: false +type: security-advisory +cve: CVE-2026-46453 +severity: MEDIUM +summary: "Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation" +description: "The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS and ID. The string values of these header constants, defined in ElasticSearchRestClientConstant, are plain unprefixed names ('SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', 'ID') rather than the 'Camel'-prefixed names used by every other Camel c [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix renames the camel-elasticsearch-rest-client Exchange header constant string values (ID, SEARCH_QUERY, INDEX_SETTINGS, INDEX_NAME, OPERATION) to carry the Camel prefix (CamelElasticsearchId, CamelElasticsearchSear [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.3.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23508 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23212 (commit 81f3a625c8853d6dff5fd748a0da9dba259c4076) and backported to camel-4.18.x (commit ff88400e3a95af16e17d553b34d3752d96496c5d, PR #23244) and camel-4.14.x (commit 0a87d31c8d19f59da4a5477bde192cc258ecc5d7, PR #23360). The issue is classified as CWE-20 (Improper Input Val [...] diff --git a/content/security/CVE-2026-46453.txt.asc b/content/security/CVE-2026-46453.txt.asc new file mode 100644 index 00000000..58350af7 --- /dev/null +++ b/content/security/CVE-2026-46453.txt.asc @@ -0,0 +1,31 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-46453" +date: 2026-06-09T10:00:00+02:00 +url: /security/CVE-2026-46453.html +draft: false +type: security-advisory +cve: CVE-2026-46453 +severity: MEDIUM +summary: "Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation" +description: "The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS and ID. The string values of these header constants, defined in ElasticSearchRestClientConstant, are plain unprefixed names ('SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', 'ID') rather than the 'Camel'-prefixed names used by every other Camel c [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix renames the camel-elasticsearch-rest-client Exchange header constant string values (ID, SEARCH_QUERY, INDEX_SETTINGS, INDEX_NAME, OPERATION) to carry the Camel prefix (CamelElasticsearchId, CamelElasticsearchSear [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.3.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23508 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23212 (commit 81f3a625c8853d6dff5fd748a0da9dba259c4076) and backported to camel-4.18.x (commit ff88400e3a95af16e17d553b34d3752d96496c5d, PR #23244) and camel-4.14.x (commit 0a87d31c8d19f59da4a5477bde192cc258ecc5d7, PR #23360). The issue is classified as CWE-20 (Improper Input Val [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovy8EACgkQ406fOAL/ +QQAFEAgAhox0nKt3x1kgCiO+K6E7x1TMOP5lvJgVc/jWdw66LONWrPYyrBR8Q9Il +6xref4IIj3IxfyEyzyRFSDtowLhkouwhepZF02QWSo9HXMpCjraYHdf0or6JCoD0 +VW7yFzfjImth+DCeOXyj+P77O2VESa0BA+wM4VwZ4qjXXcGA9yr+YbZvUGMkG7Op +fz6PsxtgLkUbZbqJn+1RKAKRn9AMyH01qtwna5aSuCia9aZiEfsTYefqMG74E6l7 +B2rIfvzdteXfvQuzCDSIbkAP0OIKBlxXrUki++d242MvqoiLGmOrMpZjHo3z0GQt +nPQ3nrXhkjhzlqJV+RtpAI5leGvPng== +=2lE+ +-----END PGP SIGNATURE-----
