This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 8a7bb202ab2a8348e2a935fabee6eefa131cb531 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Jun 15 12:27:06 2026 +0200 Added CVE-2026-48204 Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-48204.md | 17 +++++++++++++++++ content/security/CVE-2026-48204.txt.asc | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/content/security/CVE-2026-48204.md b/content/security/CVE-2026-48204.md new file mode 100644 index 00000000..28220e1d --- /dev/null +++ b/content/security/CVE-2026-48204.md @@ -0,0 +1,17 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-48204" +date: 2026-06-11T10:00:00+02:00 +url: /security/CVE-2026-48204.html +draft: false +type: security-advisory +cve: CVE-2026-48204 +severity: MEDIUM +summary: "Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration" +description: "The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start w [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive GridFS operations or metadata via the raw header names must use CamelGridFsOperation / CamelGridFsObjectId / CamelGridFsMetadata / CamelGridFsChunkSize / CamelGridFsFileId instead of th [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23575 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23413 (commit 8f0b1acfb89867bc28805d8281fa5c70192e2122) and backported to camel-4.18.x (commit 054d0c1e6c63f06b1a890c93f24115ee9bd110a8) and camel-4.14.x (commit 9915ad461dad8f5073782f643557bf1e7ae3bc31). The fix renames the camel-mongodb-gridfs Exchange header values to the Came [...] diff --git a/content/security/CVE-2026-48204.txt.asc b/content/security/CVE-2026-48204.txt.asc new file mode 100644 index 00000000..53e21a78 --- /dev/null +++ b/content/security/CVE-2026-48204.txt.asc @@ -0,0 +1,31 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-48204" +date: 2026-06-11T10:00:00+02:00 +url: /security/CVE-2026-48204.html +draft: false +type: security-advisory +cve: CVE-2026-48204 +severity: MEDIUM +summary: "Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration" +description: "The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start w [...] +mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive GridFS operations or metadata via the raw header names must use CamelGridFsOperation / CamelGridFsObjectId / CamelGridFsMetadata / CamelGridFsChunkSize / CamelGridFsFileId instead of th [...] +credit: "This issue was discovered by Yu Bao from PayPal" +affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0." +fixed: 4.14.8, 4.18.3 and 4.21.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23575 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23413 (commit 8f0b1acfb89867bc28805d8281fa5c70192e2122) and backported to camel-4.18.x (commit 054d0c1e6c63f06b1a890c93f24115ee9bd110a8) and camel-4.14.x (commit 9915ad461dad8f5073782f643557bf1e7ae3bc31). The fix renames the camel-mongodb-gridfs Exchange header values to the Came [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovx0kACgkQ406fOAL/ +QQBy7Qf+PZtbscveQfEM3SNE/x9DisDgrtMZUOdd4X3RwopRdO9zLp5lDn1o+84U +TiqqxK4j5+3UNtCoZYYB1tSyb/yPSngOfERj6Cd+CVkuu7YY+E9UJmEdrxSrdvk6 +Asn2pV6IlODFQsPAIlcPzQCOaus4p73HFyIMA9KgvTfg5zPwrbtwKz8rxQsxxNFR +/sqGtGMvoUBjHEyfk4HGChiFbNIC1E+Uq00kol6ryUpdSm9bMFjzgi4xJjwR/EZN +Llfm5RuB8dJtqfcT977kKNjfqfLsp9PkCcSoO3GtfNxOkSmSPB/VnBjW9SO4MOse +jXZppx5SOS/A8U9b4Oj3gDLURQ9ixQ== +=OkJF +-----END PGP SIGNATURE-----
