You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/04/27 07:36:04 UTC
(camel-website) 04/08: Added fixed field to CVE-2026-40048
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit d60a6def0d1b1c7dd1e1bb16f0ef093cab5b2df1
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Apr 27 09:29:03 2026 +0200
Added fixed field to CVE-2026-40048
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-40048.md | 1 +
content/security/CVE-2026-40048.txt.asc | 1 +
2 files changed, 2 insertions(+)
diff --git a/content/security/CVE-2026-40048.md b/content/security/CVE-2026-40048.md
index 5aed7e4c..2a9a9181 100644
--- a/content/security/CVE-2026-40048.md
+++ b/content/security/CVE-2026-40048.md
@@ -11,6 +11,7 @@ description: "The Camel-PQC FileBasedKeyLifecycleManager class deserializes the
mitigation: "Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2."
credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation and Venkatraman Kumar from Securin"
affected: From 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.
+fixed: 4.18.2 and 4.20.0
---
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23200 refers to the various commits that resolved the issue, and have more details.
diff --git a/content/security/CVE-2026-40048.txt.asc b/content/security/CVE-2026-40048.txt.asc
index 9591cb33..0a88e2f7 100644
--- a/content/security/CVE-2026-40048.txt.asc
+++ b/content/security/CVE-2026-40048.txt.asc
@@ -14,6 +14,7 @@ description: "The Camel-PQC FileBasedKeyLifecycleManager class deserializes the
mitigation: "Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2."
credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation and Venkatraman Kumar from Securin"
affected: From 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.
+fixed: 4.18.2 and 4.20.0
- ---
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23200 refers to the various commits that resolved the issue, and have more details.