You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/07/05 09:20:55 UTC
(camel-website) 10/31: Added CVE-2026-46584
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 0ccf2eb9a6cb5064cdd2606a1ba370088cec2d3c
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Jun 15 12:27:06 2026 +0200
Added CVE-2026-46584
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-46584.md | 17 +++++++++++++++++
content/security/CVE-2026-46584.txt.asc | 31 +++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/content/security/CVE-2026-46584.md b/content/security/CVE-2026-46584.md
new file mode 100644
index 00000000..23e644ef
--- /dev/null
+++ b/content/security/CVE-2026-46584.md
@@ -0,0 +1,17 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-46584"
+date: 2026-06-10T10:00:00+02:00
+url: /security/CVE-2026-46584.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46584
+severity: MEDIUM
+summary: "Apache Camel: Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties, allowing an attacker to weaken the SMTP transport security and, on releases before 4.19.0, redirect the connection and steal the configured SMTP credentials"
+description: "The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values applied as JavaMail session properties, overriding the endpoint configuration. This namespace is Camel-internal - only MailProducer interprets it - and was not blocked by any HeaderFilterStrategy, so the values could originate from any inbound protocol (f [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the per-message override is disabled by default; enable it only on trusted endpoints with useJavaMailSessionPropertiesFromHeaders=true. For deployments that cannot upgrade immediately, strip the namespac [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23522 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23362 (commit 1e31abca3213cde447a2ded1adc070ffec6836f1) and backported to camel-4.18.x (commit 725175e3aa16216361acc8497345f8e00536d2e0) and camel-4.14.x (commit 2d2815d256068f15d42da3af27fa86fb5efad2ab). The fix gates the per-message JavaMail session-property override behind a n [...]
diff --git a/content/security/CVE-2026-46584.txt.asc b/content/security/CVE-2026-46584.txt.asc
new file mode 100644
index 00000000..16888bc4
--- /dev/null
+++ b/content/security/CVE-2026-46584.txt.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-46584"
+date: 2026-06-10T10:00:00+02:00
+url: /security/CVE-2026-46584.html
+draft: false
+type: security-advisory
+cve: CVE-2026-46584
+severity: MEDIUM
+summary: "Apache Camel: Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties, allowing an attacker to weaken the SMTP transport security and, on releases before 4.19.0, redirect the connection and steal the configured SMTP credentials"
+description: "The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values applied as JavaMail session properties, overriding the endpoint configuration. This namespace is Camel-internal - only MailProducer interprets it - and was not blocked by any HeaderFilterStrategy, so the values could originate from any inbound protocol (f [...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the per-message override is disabled by default; enable it only on trusted endpoints with useJavaMailSessionPropertiesFromHeaders=true. For deployments that cannot upgrade immediately, strip the namespac [...]
+credit: "This issue was discovered by Yu Bao from PayPal"
+affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.14.8, 4.18.3 and 4.21.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23522 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23362 (commit 1e31abca3213cde447a2ded1adc070ffec6836f1) and backported to camel-4.18.x (commit 725175e3aa16216361acc8497345f8e00536d2e0) and camel-4.14.x (commit 2d2815d256068f15d42da3af27fa86fb5efad2ab). The fix gates the per-message JavaMail session-property override behind a n [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmovx0kACgkQ406fOAL/
+QQDMJQf9GjkfokoQKuFxNlvSJLF6Y5Y5W/4GOogvmeotH/raojPaMIbG3wx9crKt
+i1LnogtEM8e1+7eUxfNdztrfUIow4T+/2wnSgBdhOaH83oyAZ6sxdXd6eFZn2RFn
+dzotNlQ/ugOff/G7GrBgfQLIJJwdHb8DrJL7RgCidTcv38GdbkaDPsesaI0XS178
+TBhWaENPKcxpPrrPLLKytWvaa7WOFS1DIgBf2RxvtX7aL7YXF5KqxUQeoizjzvhh
+pgGRQSOVT74KoB7fjNewszWXgV0g3kCyeCIbNUHLtkCkgdqMGFvfyHw0OwRvEs4J
+1Gs2pOrjek13YNYkXX/U11s2ZbX0DQ==
+=PmUn
+-----END PGP SIGNATURE-----