You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@security.apache.org by pk...@apache.org on 2026/08/03 11:24:46 UTC
(security-site) branch main updated: Add BifroMQ threat model (#81)
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/security-site.git
The following commit(s) were added to refs/heads/main by this push:
new bce87b22 Add BifroMQ threat model (#81)
bce87b22 is described below
commit bce87b22eee208198ef00966d176158f83b8ed02
Author: Piotr P. Karwasz <pk...@apache.org>
AuthorDate: Mon Aug 3 13:24:40 2026 +0200
Add BifroMQ threat model (#81)
* Add BifroMQ threat model
Adds a reference to the Apache BifroMQ security model to
`security.apache.org`, and with it the first BifroMQ entry in the
projects overview.
Assisted-By: Claude Opus 5 (1M context) <no...@anthropic.com>
* Regenerate project pages
Picks up the current CVE feed and project metadata:
* Fluss has graduated, so it is no longer listed as "(Incubating)".
* Refreshed "last updated" stamps on three Thrift advisories.
* Drops CVE-2026-66713 from the Axis page. The record is still
PUBLISHED at MITRE, but it is no longer present in
https://cveprocess.apache.org/publicjson, which is what these pages
are generated from.
Assisted-By: Claude Opus 5 (1M context) <no...@anthropic.com>
---
content/projects/_index.md | 11 +++++++++--
content/projects/axis/_index.md | 37 -------------------------------------
content/projects/fluss/_index.md | 6 +++---
content/projects/thrift/_index.md | 6 +++---
scripts/project-coordinates.json | 8 ++++++++
5 files changed, 23 insertions(+), 45 deletions(-)
diff --git a/content/projects/_index.md b/content/projects/_index.md
index 3c968835..01c379a4 100644
--- a/content/projects/_index.md
+++ b/content/projects/_index.md
@@ -160,6 +160,13 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
[security@apache.org](mailto:security@apache.org?subject=Beam)
- Advisories (experimental):\
none so far
+- **Apache BifroMQ**
+ - **Security contact:**\
+ [security@apache.org](mailto:security@apache.org?subject=BifroMQ)
+ - Advisories (experimental):\
+ none so far
+ - Security model:
+ - [Apache BifroMQ security model](https://bifromq.apache.org/docs/admin_guide/security/intro/)
- <img class="project-logo" src="https://www.apache.org/logos/res/bigtop/default.png" alt="" loading="lazy"> **Apache Bigtop**
- **Security contact:**\
[security@apache.org](mailto:security@apache.org?subject=Bigtop)
@@ -447,9 +454,9 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
[flink.apache.org](https://flink.apache.org/what-is-flink/security/)
- Security model:
- [Apache Flink security model](https://flink.apache.org/what-is-flink/security/)
-- **Apache Fluss (Incubating)**
+- **Apache Fluss**
- **Security contact:**\
- [security@apache.org](mailto:security@apache.org?subject=Fluss%20%28Incubating%29)
+ [security@apache.org](mailto:security@apache.org?subject=Fluss)
- Advisories (experimental):\
[security.apache.org](/projects/fluss/)
- **Apache Fory**
diff --git a/content/projects/axis/_index.md b/content/projects/axis/_index.md
index 750d53cb..1e84f7ca 100644
--- a/content/projects/axis/_index.md
+++ b/content/projects/axis/_index.md
@@ -20,43 +20,6 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security pages linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
-## deserialization of untrusted Data ## { #CVE-2026-66713 }
-
-CVE-2026-66713 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66713) [\[CVE json\]](./CVE-2026-66713.cve.json) [\[OSV json\]](./CVE-2026-66713.osv.json)
-
-
-
-_Last updated: 2026-07-28T13:44:22.395Z_
-
-### Affected
-
-* Apache Axis2/Java through 2.0.0
-
-
-### Description
-
-<span style="background-color: rgb(255, 255, 255);">Deserialization</span> <span style="background-color: rgb(255, 255, 255);">of</span> <span style="background-color: rgb(255, 255, 255);">Untrusted</span> <span style="background-color: rgb(255, 255, 255);">Data</span> <span style="background-color: rgb(255, 255, 255);">(CWE-502)</span> <span style="background-color: rgb(255, 255, 255);">in</span> <span style="background-color: rgb(255, 255, 255);">the</span> <span style="background-colo [...]
-<br><span style="background-color: rgb(255, 255, 255);"> in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</span>
-<br><span style="background-color: rgb(255, 255, 255);"> </span><span style="background-color: rgb(255, 255, 255);">(only</span> <span style="background-color: rgb(255, 255, 255);">when</span> <span style="background-color: rgb(255, 255, 255);">Tribes</span> <span style="background-color: rgb(255, 255, 255);">clustering</span> <span style="background-color: rgb(255, 255, 255);">is</span> <span style="background-color: rgb(255, 255, 255);">enabled,</span> <span style="background-col [...]
-<br><span style="background-color: rgb(255, 255, 255);"> unauthenticated remote attacker with network access to the clustering port to</span>
-<br><span style="background-color: rgb(255, 255, 255);"> execute</span> <span style="background-color: rgb(255, 255, 255);">arbitrary</span> <span style="background-color: rgb(255, 255, 255);">code</span> <span style="background-color: rgb(255, 255, 255);">via</span> <span style="background-color: rgb(255, 255, 255);">a</span> <span style="background-color: rgb(255, 255, 255);">crafted</span> <span style="background-color: rgb(255, 255, 255);">serialized</span> <span style="backgro [...]
-<br><span style="background-color: rgb(255, 255, 255);"> </span><span style="background-color: rgb(255, 255, 255);">channel</span> <span style="background-color: rgb(255, 255, 255);">and</span> <span style="background-color: rgb(255, 255, 255);">deserialized</span> <span style="background-color: rgb(255, 255, 255);">in</span>
-<br><span style="background-color: rgb(255, 255, 255);"> org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</span>
-<br><span style="background-color: rgb(255, 255, 255);"> recommended</span> <span style="background-color: rgb(255, 255, 255);">to</span> <span style="background-color: rgb(255, 255, 255);">upgrade</span> <span style="background-color: rgb(255, 255, 255);">to</span> <span style="background-color: rgb(255, 255, 255);">version</span> <span style="background-color: rgb(255, 255, 255);">2.0.1,</span> <span style="background-color: rgb(255, 255, 255);">which</span> <span style="backgrou [...]
-<br><span style="background-color: rgb(255, 255, 255);"> clustering feature entirely.</span><br>
-<br>
-
-<br>
-
-### References
-* https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15
-* https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728
-
-
-### Credits
-* liuhuajin of Huawei (finder)
-
-
## Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API ## { #CVE-2023-51441 }
CVE-2023-51441 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2023-51441) [\[CVE json\]](./CVE-2023-51441.cve.json) [\[OSV json\]](./CVE-2023-51441.osv.json)
diff --git a/content/projects/fluss/_index.md b/content/projects/fluss/_index.md
index 32d6f65e..a5ac8bd0 100644
--- a/content/projects/fluss/_index.md
+++ b/content/projects/fluss/_index.md
@@ -1,12 +1,12 @@
---
-title: Apache Fluss (Incubating) security advisories
-description: Security information for Apache Fluss (Incubating)
+title: Apache Fluss security advisories
+description: Security information for Apache Fluss
layout: single
---
# Reporting
-Do you want disclose a potential security issue for Apache Fluss (Incubating)? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss%20%28Incubating%29).
+Do you want disclose a potential security issue for Apache Fluss? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss).
# Advisories
diff --git a/content/projects/thrift/_index.md b/content/projects/thrift/_index.md
index cee36f2b..1f6391cc 100644
--- a/content/projects/thrift/_index.md
+++ b/content/projects/thrift/_index.md
@@ -387,7 +387,7 @@ CVE-2026-43870 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43870) [\[CVE jso
-_Last updated: 2026-05-05T07:45:34.804Z_
+_Last updated: 2026-08-01T15:14:33.689Z_
### Affected
@@ -408,7 +408,7 @@ CVE-2026-43869 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43869) [\[CVE jso
-_Last updated: 2026-05-05T07:25:46.713Z_
+_Last updated: 2026-08-01T15:15:50.815Z_
### Affected
@@ -476,7 +476,7 @@ CVE-2026-41608 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-41608) [\[CVE jso
-_Last updated: 2026-07-27T10:53:37.845Z_
+_Last updated: 2026-08-01T15:15:08.921Z_
### Affected
diff --git a/scripts/project-coordinates.json b/scripts/project-coordinates.json
index cacf1862..01dd3e1c 100644
--- a/scripts/project-coordinates.json
+++ b/scripts/project-coordinates.json
@@ -191,6 +191,14 @@
"contact": "security@apache.org",
"logo_link": "https://www.apache.org/logos/res/beam/default.png"
},
+ "bifromq": {
+ "name": "Apache BifroMQ",
+ "security_model_link": "https://bifromq.apache.org/docs/admin_guide/security/intro/",
+ "security_model_source": "https://raw.githubusercontent.com/apache/bifromq-sites/master/docs/admin_guide/security/intro.md",
+ "advisory_link": null,
+ "contact": "security@apache.org",
+ "logo_link": null
+ },
"bigtop": {
"name": "Apache Bigtop",
"security_model_link": null,