This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch karavan-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 81a3b854839a9dc57ff629ec4529ffd2b84ff08c Author: Andrea Cosentino <[email protected]> AuthorDate: Wed Oct 7 10:57:31 2026 +0200 chore: add Karavan security advisories for CVE-2026-103412 and CVE-2026-103413 Path traversal in project file names on the Git commit path (CVE-2026-103412) and unvalidated Kubernetes resource application from a project's kubernetes.yaml (CVE-2026-103413). Both fixed in Karavan 4.22.1, which is the only release carrying the fix - Karavan has no maintenance branches. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01LhQkuMMro7EkXxjU8XYryx --- content/security/CVE-2026-103412.md | 19 +++++++++++++++++ content/security/CVE-2026-103412.txt.asc | 33 ++++++++++++++++++++++++++++++ content/security/CVE-2026-103413.md | 21 +++++++++++++++++++ content/security/CVE-2026-103413.txt.asc | 35 ++++++++++++++++++++++++++++++++ 4 files changed, 108 insertions(+) diff --git a/content/security/CVE-2026-103412.md b/content/security/CVE-2026-103412.md new file mode 100644 index 00000000..08c7660d --- /dev/null +++ b/content/security/CVE-2026-103412.md @@ -0,0 +1,19 @@ +--- +title: "Apache Camel Karavan Security Advisory - CVE-2026-103412" +date: 2026-10-07T11:00:00+02:00 +url: /security/CVE-2026-103412.html +draft: false +type: security-advisory +cve: CVE-2026-103412 +severity: HIGH +summary: "Karavan project file names escape the project directory when a project is committed to Git" +description: "Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use [...] +mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the only release containing the fix." +credit: "This issue was discovered and reported by CyberLeo" +affected: "From 3.18.0 before 4.22.1." +fixed: 4.22.1 +--- + +Project file names and project ids received through the project file API are now validated before they are used as path segments: names that are empty, contain `..`, a path separator or a NUL byte, or that fall outside `^[a-zA-Z0-9_\-.]+$` are rejected on create, update, rename and copy. The path built for each file is additionally resolved against the project directory and refused if the result escapes it, so the write itself is guarded independently of the entry point. + +The commit https://github.com/apache/camel-karavan/commit/5e4252494817af0cd2697216bd02f361037fedcf resolved the issue and has more details. diff --git a/content/security/CVE-2026-103412.txt.asc b/content/security/CVE-2026-103412.txt.asc new file mode 100644 index 00000000..e49a8b26 --- /dev/null +++ b/content/security/CVE-2026-103412.txt.asc @@ -0,0 +1,33 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Karavan Security Advisory - CVE-2026-103412" +date: 2026-10-07T11:00:00+02:00 +url: /security/CVE-2026-103412.html +draft: false +type: security-advisory +cve: CVE-2026-103412 +severity: HIGH +summary: "Karavan project file names escape the project directory when a project is committed to Git" +description: "Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use [...] +mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the only release containing the fix." +credit: "This issue was discovered and reported by CyberLeo" +affected: "From 3.18.0 before 4.22.1." +fixed: 4.22.1 +- --- + +Project file names and project ids received through the project file API are now validated before they are used as path segments: names that are empty, contain `..`, a path separator or a NUL byte, or that fall outside `^[a-zA-Z0-9_\-.]+$` are rejected on create, update, rename and copy. The path built for each file is additionally resolved against the project directory and refused if the result escapes it, so the write itself is guarded independently of the entry point. + +The commit https://github.com/apache/camel-karavan/commit/5e4252494817af0cd2697216bd02f361037fedcf resolved the issue and has more details. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrGC7wACgkQ406fOAL/ +QQDTwwf5AdAELHf889yP04lm7Z0TvMeGJ9SPIUGhxw1IlCsWuRQi+eDw/8+bmAEV +tkQCC45g+KvS8MN6EcbBlmpsgx8hZf3xaNTN+JmVqG2RLrEXGV9tpwVPOn5yP9Pb +To7fSV//xuB9SnL8blNRhup/9miG38xvO4rsKBRS69ACipRVFzTAogKQooM5Ho/T +eTxhBUiezVKLgeyUttApqM+t1xkMbGKlz9TFl5lDjcYTh6Yd/jxjkp/qjdSPnvpD +ywY2rXc9i3VG9QVKICz40LOFWBzDIfP4k7rt4miaCVcyvoWHkHE5MBp2HSP0YUML +VhVf1hTm1n1iXoshF33dbkDyR4X7DQ== +=3tHY +-----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-103413.md b/content/security/CVE-2026-103413.md new file mode 100644 index 00000000..5b0122dc --- /dev/null +++ b/content/security/CVE-2026-103413.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Karavan Security Advisory - CVE-2026-103413" +date: 2026-10-07T11:00:00+02:00 +url: /security/CVE-2026-103413.html +draft: false +type: security-advisory +cve: CVE-2026-103413 +severity: HIGH +summary: "Karavan applies unvalidated Kubernetes resources from a project's kubernetes.yaml" +description: "Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, inc [...] +mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the only release containing the fix. Operators should also ensure PodSecurity admission is enforced on the namespace Karavan deploys into, and keep the service account's RBAC no wider than Karavan requires." +credit: "This issue was discovered and reported by MopMonk-AI" +affected: "From 4.0.0 before 4.22.1." +fixed: 4.22.1 +--- + +Resources read from a project's `kubernetes.yaml` are now validated before they are applied. Each item's kind must appear in `karavan.deployment.allowed-kinds` (`Deployment,Service,ConfigMap,Secret,Ingress` as shipped), pod specifications requesting `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports, privileged containers, `allowPrivilegeEscalation` or added capabilities are rejected, and the namespace of every applied resource is pinned to Karavan's own regardless of wh [...] + +This validation is a restriction on what a project file may ask the cluster for; it is not a sandbox around user-authored deployment artifacts, and the Karavan security model continues to treat an authenticated Karavan user as a trusted deployment operator. + +The commit https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571 resolved the issue and has more details. diff --git a/content/security/CVE-2026-103413.txt.asc b/content/security/CVE-2026-103413.txt.asc new file mode 100644 index 00000000..c8b63809 --- /dev/null +++ b/content/security/CVE-2026-103413.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Karavan Security Advisory - CVE-2026-103413" +date: 2026-10-07T11:00:00+02:00 +url: /security/CVE-2026-103413.html +draft: false +type: security-advisory +cve: CVE-2026-103413 +severity: HIGH +summary: "Karavan applies unvalidated Kubernetes resources from a project's kubernetes.yaml" +description: "Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, inc [...] +mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the only release containing the fix. Operators should also ensure PodSecurity admission is enforced on the namespace Karavan deploys into, and keep the service account's RBAC no wider than Karavan requires." +credit: "This issue was discovered and reported by MopMonk-AI" +affected: "From 4.0.0 before 4.22.1." +fixed: 4.22.1 +- --- + +Resources read from a project's `kubernetes.yaml` are now validated before they are applied. Each item's kind must appear in `karavan.deployment.allowed-kinds` (`Deployment,Service,ConfigMap,Secret,Ingress` as shipped), pod specifications requesting `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports, privileged containers, `allowPrivilegeEscalation` or added capabilities are rejected, and the namespace of every applied resource is pinned to Karavan's own regardless of wh [...] + +This validation is a restriction on what a project file may ask the cluster for; it is not a sandbox around user-authored deployment artifacts, and the Karavan security model continues to treat an authenticated Karavan user as a trusted deployment operator. + +The commit https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571 resolved the issue and has more details. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrGC8IACgkQ406fOAL/ +QQDWUAgAgsLUfslSVd2uSdWK2HKrQXF8TXqXqECTI/Fi6UxzVXHsbiyGZYFmGGnD +F9RPXNbzfXWccfKxKQQmhgSNSO0OWYxDrwdU4O94yUI2Rf5D5xNMbTDQf2p+CS0f +GDwR9G5g6LvcetXHOT7M8/LC8TK1z3/h+bU9CFdHs1ulsSQdIB+ij9Gme8mlr04Q +CP4+kmJrZ+tXbTdJ8+KF3dg3oNH8Jwdw1Tcnn2nqEz3pdjlpN3wO912c3+ObRoKF +b6DoWouNlUVZKDrfn/4n/h+UJLPV8VKNGTunqhhk47g1906VY0fETWvQ2HztHIzD +Tnm7VjA3eBk4ULqDsTFPzMhz3jrDQw== +=5HZP +-----END PGP SIGNATURE-----
