You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/04/27 07:36:01 UTC
(camel-website) 01/08: Added fixed field for CVE-2026-27172
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit bc2cea1e40eee3d3830c120fd21c38d89b9aef70
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Apr 27 09:24:15 2026 +0200
Added fixed field for CVE-2026-27172
Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
content/security/CVE-2026-27172.md | 1 +
content/security/CVE-2026-27172.txt.asc | 5 +++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/content/security/CVE-2026-27172.md b/content/security/CVE-2026-27172.md
index 8d39800e..98f292b6 100644
--- a/content/security/CVE-2026-27172.md
+++ b/content/security/CVE-2026-27172.md
@@ -11,6 +11,7 @@ description: "The ConsulRegistry in the camel-consul component (class org.apache
mitigation: "Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1."
credit: "This issue was discovered and fixed by Andrea Cosentino of Apache Software Foundation"
affected: "From 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1"
+fixed: 4.14.6, 4.18.1 and 4.19.0
---
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23029 refers to the commits that resolved the issue and has more details. The vulnerability is of the same class as CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747: a Camel component reads Java-serialized bytes from a backing store and passes them to ObjectInputStream.readObject() without any class allowlist, so an attacker who can influence the bytes in that store can trigger arbitrary code execution via a gadget chain. In c [...]
diff --git a/content/security/CVE-2026-27172.txt.asc b/content/security/CVE-2026-27172.txt.asc
index 2cf6685a..eb35f7b6 100644
--- a/content/security/CVE-2026-27172.txt.asc
+++ b/content/security/CVE-2026-27172.txt.asc
@@ -1,7 +1,7 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
-- ---
+----
title: "Apache Camel Security Advisory - CVE-2026-27172"
date: 2026-04-24T09:00:00+02:00
url: /security/CVE-2026-27172.html
@@ -14,7 +14,8 @@ description: "The ConsulRegistry in the camel-consul component (class org.apache
mitigation: "Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1."
credit: "This issue was discovered and fixed by Andrea Cosentino of Apache Software Foundation"
affected: "From 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1"
-- ---
+fixed: 4.14.6, 4.18.1 and 4.19.0
+----
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23029 refers to the commits that resolved the issue and has more details. The vulnerability is of the same class as CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747: a Camel component reads Java-serialized bytes from a backing store and passes them to ObjectInputStream.readObject() without any class allowlist, so an attacker who can influence the bytes in that store can trigger arbitrary code execution via a gadget chain. In c [...]
-----BEGIN PGP SIGNATURE-----