You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/10/15 15:39:10 UTC
(camel-website) 41/44: Correct the mitigation in CVE-2026-79984 and re-sign it
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch new-wave-of-cves
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 8e0881f67104270369bcb0badc84fe4a2e5ca7f4
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Oct 12 17:47:32 2026 +0200
Correct the mitigation in CVE-2026-79984 and re-sign it
The mitigation said the 4.14.x stream does not receive this fix, but
camel-mina-sftp first shipped in 4.18.0, so 4.14.x is not affected. It now
names the end-of-life streams inside the affected ranges, 4.19.x to 4.21.x.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-79984.md | 2 +-
content/security/CVE-2026-79984.txt.asc | 18 +++++++++---------
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/content/security/CVE-2026-79984.md b/content/security/CVE-2026-79984.md
index 1289354d..db39e720 100644
--- a/content/security/CVE-2026-79984.md
+++ b/content/security/CVE-2026-79984.md
@@ -8,7 +8,7 @@ cve: CVE-2026-79984
severity: HIGH
summary: "Camel-Mina-SFTP: the consumer built the remote path of a polled file from the name reported in the server directory listing without constraining it to the polled directory, so a crafted listing entry could be retrieved, deleted or renamed outside it"
description: "The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on [...]
-mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs on, and a [...]
+mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.19.x to 4.21.x streams reached end of life and do not receive this fix; users on them should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs [...]
credit: "This issue was discovered by Dilrevx from NSSL, SJTU"
affected: "From 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1."
fixed: 4.18.5, 4.22.1 and 4.23.0
diff --git a/content/security/CVE-2026-79984.txt.asc b/content/security/CVE-2026-79984.txt.asc
index 94df6fea..5cdf366a 100644
--- a/content/security/CVE-2026-79984.txt.asc
+++ b/content/security/CVE-2026-79984.txt.asc
@@ -11,7 +11,7 @@ cve: CVE-2026-79984
severity: HIGH
summary: "Camel-Mina-SFTP: the consumer built the remote path of a polled file from the name reported in the server directory listing without constraining it to the polled directory, so a crafted listing entry could be retrieved, deleted or renamed outside it"
description: "The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on [...]
-mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs on, and a [...]
+mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.19.x to 4.21.x streams reached end of life and do not receive this fix; users on them should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs [...]
credit: "This issue was discovered by Dilrevx from NSSL, SJTU"
affected: "From 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1."
fixed: 4.18.5, 4.22.1 and 4.23.0
@@ -24,12 +24,12 @@ The fix was merged on main in https://github.com/apache/camel/pull/25730 (commit
The issue is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The affected range starts at 4.18.0 because the camel-mina-sftp component was introduced in that release. Its consumer derives from the same RemoteFileConsumer base class as the ftp and sftp consumers and inherited the same unconstrained resolution. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 o [...]
-----BEGIN PGP SIGNATURE-----
-iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqtBSwACgkQ406fOAL/
-QQB5tQf+MllOOOYTV0R+j2MJaFF5RAPcHiT26F16l8CBMgXhZuZHUZbGxJLcu5wZ
-Qf+Ivm1mCAQENQ+7magEuuRPGOlJcN/F+UsJKdj6RDy4nkaAwPeN8NSdPDgkHCTI
-jV5Vd9qzACsIXUfo1zHKmVM+DVm5RCx59qGMXad8wzkdm4ctwTBt5y/tUawaET3K
-g5fpWkoPyQRhcq6UzwFMCgvpsoWb/PU33LNmA2ug3/EeF7ti/6UCboE/EJrY0q5/
-eIzFsy1g0OyQ/K6rJ30RxFzeyEZJfINOWzb2JBhjCKS8Cj86GLpSLEsLRSKg/icf
-O12tRZ5r4eveq+zNlfZuOJG31nNmiA==
-=PO2o
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrNAQcACgkQ406fOAL/
+QQCtIwf/d0Iuk6fDkK7GgLCJvt2SCHrQpIzurVtWB4xFcXsXEqUHH5Hc7vlCmcqQ
+/I3XBfuuzIU5uoxV/fEYVD6N41yR5P2VAiJc9cmIt0zWBkUpgJWY1d9oCNafWqUo
+5MboWdwGRquPWJ2oDcBD+oK69NIPYzvCfWDjXvf1RqYuxBMLxf0InH47JnSYLHRK
+GqYyvvX++vug4jvl4meVk8WCL9wjezKBv7A4m6TUSVn8NGrTbFH5iM2ARAPzcVRi
+du/2pgBse0yqZEH18XoOIRwYqaLcoOp+L6QkFClGICARf4xVdzcVn5acnp/pJLID
+GG/AYzTETYW41/fCcXBQCAzh6tJmOw==
+=XSGZ
-----END PGP SIGNATURE-----