You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "ivonaest (via GitHub)" <gi...@apache.org> on 2026/08/24 09:37:17 UTC
[PR] Pinned api-ldap-client-api to 2.1.8 to remediate CVEs [camel]
ivonaest opened a new pull request, #25622:
URL: https://github.com/apache/camel/pull/25622
# Description
Added override for apacheds-core-api which is transitively brought from ApacheDS. ApacheDS is dormant project and it won't release new version on Github. Apache Directory API project has released 2.1.8 with fix.
This version bump remediates CVE-2026-35563 [NVD-CVE](https://nvd.nist.gov/vuln/detail/CVE-2026-35563).
# Target
- [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch)
# Tracking
- [ ] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it).
# Apache Camel coding standards and style
- [x] I checked that each commit in the pull request has a meaningful subject line and body.
<!--
If you're unsure, you can format the pull request title like `[CAMEL-XXX] Fixes bug in camel-file component`, where you replace `CAMEL-XXX` with the appropriate JIRA issue.
-->
- [x] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pinned api-ldap-client-api to 2.1.8 to remediate CVEs [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5394132162
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `parent`
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 8 tested, 0 compile-only — current: 0 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **8 affected modules** (current approach: 0).
<details><summary>:warning: Modules only in Scalpel (8)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-ldap`
- `camel-ldif`
- `coverage`
- `docs`
</details>
Changed properties: directory-api-version
Changed managed dependencies: org.apache.directory.api:api-ldap-client-api
**Skip-tests mode would test 8 modules** (0 direct + 0 downstream), **skip tests for 0** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (8)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-ldap`
- `camel-ldif`
- `coverage`
- `docs`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (9 modules)</summary>
- Camel :: All Components Sync point
- Camel :: Assembly
- Camel :: Component DSL
- Camel :: Coverage
- Camel :: Docs
- Camel :: Endpoint DSL
- Camel :: LDAP
- Camel :: LDIF
- Camel :: Parent
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/32712535693)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5396418076
okay you are welcome to update the PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "ivonaest (via GitHub)" <gi...@apache.org>.
ivonaest commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5395644988
`camel-ldif` uses Apache API classes in its main code and `camel-ldap` uses it for tests only
So only `camel-ldif` is necessary, but for consistency both POMs were updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5395514400
is this not only used for testing, we dont fix CVEs for test dependencies.
In this case any kind of change should be done in these 2 modules only
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "ivonaest (via GitHub)" <gi...@apache.org>.
ivonaest commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5395445394
Hi @davsclaus ,
the org.apache.directory.api isn't direct dependency but comes transitively to project through org.apache.directory.server. Both camel-ldif and camel-ldap depend on ApacheDS so they both need pin.
I pinned it in parent pom.xml to avoid duplicating the code in both camel-ldif's and camel-ldap's pom.xml.
I can apply these changes to both POMs if that is your preferred approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #25622:
URL: https://github.com/apache/camel/pull/25622
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pinned api-ldap-client-api to 2.1.8 to remediate CVEs [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5394029695
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "ivonaest (via GitHub)" <gi...@apache.org>.
ivonaest commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5396485456
So would you prefer updates to both POMs instead of the parent one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pinned api-ldap-client-api to 2.1.8 to remediate CVEs [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #25622:
URL: https://github.com/apache/camel/pull/25622#discussion_r3842769626
##########
parent/pom.xml:
##########
@@ -3704,6 +3705,11 @@
<artifactId>commons-lang3</artifactId>
<version>${commons-lang3-version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-client-api</artifactId>
+ <version>${directory-api-version}</version>
+ </dependency>
Review Comment:
⚠️ **Version skew risk** — This pins only `api-ldap-client-api` to 2.1.8, but `camel-ldif` pulls in 10 other `org.apache.directory.api` artifacts at 2.1.5 (transitively from `apacheds-core-api:2.0.0.AM27`): `api-i18n`, `api-asn1-api`, `api-ldap-extras-codec-api`, `api-ldap-codec-core`, `api-asn1-ber`, `api-ldap-extras-aci`, `api-ldap-extras-util`, `api-ldap-model`, `api-ldap-schema-data`, and `api-util`.
The 2.1.8 release includes significant internal changes (AntLR parser replacement, ASN.1 decoder fixes) that may assume consistent versions across all modules. CI is green which is encouraging, but tests may not exercise all code paths affected by the version mismatch.
Consider pinning all `org.apache.directory.api` artifacts to 2.1.8 for consistency — the existing `directory-api-version` property name already implies broader version management.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #25622:
URL: https://github.com/apache/camel/pull/25622#issuecomment-5396561002
yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #25622:
URL: https://github.com/apache/camel/pull/25622#discussion_r3845289024
##########
components/camel-ldap/pom.xml:
##########
@@ -32,6 +32,9 @@
<description>Camel LDAP support</description>
<properties>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-* (test-scope only)
Review Comment:
Nit: `CAMEL-XXXXX` doesn't need to be a real ticket reference here — the existing exclusion comments elsewhere in this file don't reference one either. A plain descriptive comment without the placeholder works fine.
##########
components/camel-ldap/pom.xml:
##########
@@ -77,5 +80,77 @@
<version>${mina-version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
Review Comment:
Rather than re-declaring 12 `org.apache.directory.api` artifacts as explicit overrides, consider excluding the whole group from the `apacheds-*` dependencies above and re-adding only the "root" artifacts actually needed — this repo already does this elsewhere (e.g. `camel-metrics/pom.xml` excludes `com.fasterxml.jackson.core:*` from `metrics-json`).
Concretely: add an `<exclusion><groupId>org.apache.directory.api</groupId><artifactId>*</artifactId></exclusion>` to `apacheds-server-jndi`, `apacheds-server-integ`, and `apacheds-core-integ` above, then re-add just `api-ldap-client-api`, `api-ldap-extras-util`, `api-ldap-codec-standalone`, `api-ldap-extras-sp`, `api-dsml-engine`, and `api-ldap-extras-trigger` (test scope). Their own transitive graphs pull the full 18-artifact closure back in at `2.1.8` automatically — no manual list to keep in sync, and it can't silently miss an artifact the way the current list does (see review summary). I verified this with `dependency:tree -Dincludes=org.apache.directory.api` before suggesting it — resolves clean with zero `2.1.5` left.
Note: re-adding only `api-ldap-client-api` alone is *not* enough — `apacheds-test-framework`/`apacheds-interceptors-hash` need the other roots independently for their own internal use, not just what Camel's code imports.
##########
components/camel-ldif/pom.xml:
##########
@@ -55,6 +58,68 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- CAMEL-XXXXX: pin org.apache.directory.api transitively brought in by
+ apacheds-core-api (dormant, no release with the fix) to remediate CVE-2026-35563 -->
+ <dependency>
Review Comment:
Same suggestion as on `camel-ldap/pom.xml`: exclude `org.apache.directory.api:*` from `apacheds-core-api` above (compile scope) and from `apacheds-server-integ`/`apacheds-core-integ` below (test scope), then re-add just `api-ldap-client-api` + `api-ldap-extras-util` (compile) and `api-ldap-codec-standalone` + `api-ldap-extras-sp` + `api-dsml-engine` + `api-ldap-extras-trigger` (test). This reconstitutes the full 18-artifact closure at `2.1.8` with correct scopes preserved automatically, instead of the current 12-entry manual list which misses 6 artifacts (still left at `2.1.5` — see review summary).
I verified this end-to-end locally, including running the real `LdifRouteIT` suite (6 tests, live OpenLDAP container, exercises the actual `LdifProducer` production code path) — all green with this restructuring.
##########
components/camel-ldap/pom.xml:
##########
@@ -32,6 +32,9 @@
<description>Camel LDAP support</description>
<properties>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-* (test-scope only)
+ transitively brings in a vulnerable version and ApacheDS is dormant with no fix release -->
+ <directory-api-version>2.1.8</directory-api-version>
Review Comment:
`apacheds-version` is already centrally managed in `parent/pom.xml:77` and shared by both `camel-ldap` and `camel-ldif`. Consider adding `directory-api-version` there too instead of duplicating the same property+value independently in both component poms — keeps the two from drifting apart on a future bump.
##########
components/camel-ldif/pom.xml:
##########
@@ -35,6 +35,9 @@
<!-- OpenLDAP container is not available on these platforms -->
<skipITs.ppc64le>true</skipITs.ppc64le>
<skipITs.s390x>true</skipITs.s390x>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-core-api transitively
+ brings in a vulnerable version and ApacheDS is dormant with no fix release -->
+ <directory-api-version>2.1.8</directory-api-version>
Review Comment:
Same as the `camel-ldap` pom: since this is consumed at compile scope here (production code via `LdifProducer`), centralizing `directory-api-version` in `parent/pom.xml` next to `apacheds-version` seems especially worthwhile rather than duplicating it across both component poms.
##########
components/camel-ldif/pom.xml:
##########
@@ -55,6 +58,68 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- CAMEL-XXXXX: pin org.apache.directory.api transitively brought in by
Review Comment:
Nit: same as in `camel-ldap/pom.xml` — `CAMEL-XXXXX` isn't needed here, a plain descriptive comment is enough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org