You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/08/24 08:21:38 UTC

(camel-website) branch CVE-more-sessions created (now 6fecdb00)

This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a change to branch CVE-more-sessions
in repository https://gitbox.apache.org/repos/asf/camel-website.git


      at 6fecdb00 Added CVE-2026-63621

This branch includes the following new commits:

     new 136f0890 Added CVE-2026-60093
     new 76850d8d Added CVE CVE-2026-66906
     new b9ea312d Added CVE-2026-66907
     new 6fecdb00 Added CVE-2026-63621

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(camel-website) 04/04: Added CVE-2026-63621

Posted by ac...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch CVE-more-sessions
in repository https://gitbox.apache.org/repos/asf/camel-website.git

commit 6fecdb004da6117fa263d2e69a4d05b2c6e3595f
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Aug 24 10:21:05 2026 +0200

    Added CVE-2026-63621
    
    Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
 content/security/CVE-2026-63621.md      | 21 ++++++++++++++++++++
 content/security/CVE-2026-63621.txt.asc | 35 +++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/content/security/CVE-2026-63621.md b/content/security/CVE-2026-63621.md
new file mode 100644
index 00000000..75f84e56
--- /dev/null
+++ b/content/security/CVE-2026-63621.md
@@ -0,0 +1,21 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-63621"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-63621.html
+draft: false
+type: security-advisory
+cve: CVE-2026-63621
+severity: MEDIUM
+summary: "Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy, so an untrusted sender could inject Camel-internal headers"
+description: "The camel-knative consumer accepts CloudEvents in two content modes. In binary mode the event attributes arrive as HTTP headers, and KnativeHttpConsumer maps them onto the message through a HeaderFilterStrategy, so Camel-internal headers are not propagated. In structured content mode, selected by the Content-Type application/cloudevents+json, the whole event is a JSON document in the request body: AbstractCloudEventProcessor parses that body and CloudEventProcessors then ma [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. The fix landed on the maintenance lines and on main only; the non-LTS 4.15.x, 4.16.x, 4.17.x, 4.19.x, 4.20.x and 4.21.x releases are affected and are no longer maintained, so users on those lines should move to 4.18.4 or [...]
+credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation"
+affected: "From 3.15.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24084 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24724 (commit bbf680af8af4a39f808727758e72d469c2eec539) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24753 (commit 5c7a8dbf1f1ed92bb4f289a50cc1765095054112) and to camel-4.14.x in https://github.com/apache/camel/pull/24751 (commit 4eb26807d40420abf45253286ce3d07c2fba448c). A follow-up documentation change, https://github.com/apache/camel/pull/24768 (commit 7a46dbbca88fba647c89da86ed172251c4622fc3 [...]
+
+The fix gives AbstractCloudEventProcessor a HeaderFilterStrategy and a shared mapExtensionAsHeader helper, and routes the structured-mode extension mapping for all supported CloudEvents spec versions through that helper, so the same filtering is applied on both content modes and Camel-internal header names are matched case-insensitively. Ordinary CloudEvent extension attributes are unaffected and continue to be propagated. The strategy is obtained differently per branch: on main the comp [...]
diff --git a/content/security/CVE-2026-63621.txt.asc b/content/security/CVE-2026-63621.txt.asc
new file mode 100644
index 00000000..812cbb6e
--- /dev/null
+++ b/content/security/CVE-2026-63621.txt.asc
@@ -0,0 +1,35 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-63621"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-63621.html
+draft: false
+type: security-advisory
+cve: CVE-2026-63621
+severity: MEDIUM
+summary: "Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy, so an untrusted sender could inject Camel-internal headers"
+description: "The camel-knative consumer accepts CloudEvents in two content modes. In binary mode the event attributes arrive as HTTP headers, and KnativeHttpConsumer maps them onto the message through a HeaderFilterStrategy, so Camel-internal headers are not propagated. In structured content mode, selected by the Content-Type application/cloudevents+json, the whole event is a JSON document in the request body: AbstractCloudEventProcessor parses that body and CloudEventProcessors then ma [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. The fix landed on the maintenance lines and on main only; the non-LTS 4.15.x, 4.16.x, 4.17.x, 4.19.x, 4.20.x and 4.21.x releases are affected and are no longer maintained, so users on those lines should move to 4.18.4 or [...]
+credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation"
+affected: "From 3.15.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24084 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24724 (commit bbf680af8af4a39f808727758e72d469c2eec539) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24753 (commit 5c7a8dbf1f1ed92bb4f289a50cc1765095054112) and to camel-4.14.x in https://github.com/apache/camel/pull/24751 (commit 4eb26807d40420abf45253286ce3d07c2fba448c). A follow-up documentation change, https://github.com/apache/camel/pull/24768 (commit 7a46dbbca88fba647c89da86ed172251c4622fc3 [...]
+
+The fix gives AbstractCloudEventProcessor a HeaderFilterStrategy and a shared mapExtensionAsHeader helper, and routes the structured-mode extension mapping for all supported CloudEvents spec versions through that helper, so the same filtering is applied on both content modes and Camel-internal header names are matched case-insensitively. Ordinary CloudEvent extension attributes are unaffected and continue to be propagated. The strategy is obtained differently per branch: on main the comp [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL+3oACgkQ406fOAL/
+QQBzXAf/SfzEZSI5aK0KE2Glrci9IxoqSywNWS/GO/0nB8uMraxGIL9qpzLeEVDk
+9/F4uKBPIGi3VaGcaqC+CHvluN0ANsYt3C5PHMRRo2+44fhPRDRwzjvRL921+kZh
+R4waSZTzrZWlj8TJ8XX2lUSwEhg71M9n+f6zfAYZi4o+HGqHykmfwXDbOpO7eBeh
+yfb7vr1Ku6z/75xAo71qWQ5x23aKZ0eqY5eLjFbRH0xCOur6zs6ZF7LlJxa337OF
+f3zb91fyyB3AP9mnyUyTB8r4CBZpLbucq+nWWb9IiLPzrnJ7QC0iJbqBK4fi7X6m
+CSFxz8Rzf7StvL2YPGEdoOk5PjslMw==
+=T9l9
+-----END PGP SIGNATURE-----

(camel-website) 01/04: Added CVE-2026-60093

Posted by ac...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch CVE-more-sessions
in repository https://gitbox.apache.org/repos/asf/camel-website.git

commit 136f08902080004f03aed8bc0cca681a930cdd72
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Aug 24 08:25:32 2026 +0200

    Added CVE-2026-60093
    
    Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
 content/security/CVE-2026-60093.md      | 21 ++++++++++++++++++++
 content/security/CVE-2026-60093.txt.asc | 35 +++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/content/security/CVE-2026-60093.md b/content/security/CVE-2026-60093.md
new file mode 100644
index 00000000..be0efa88
--- /dev/null
+++ b/content/security/CVE-2026-60093.md
@@ -0,0 +1,21 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-60093"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-60093.html
+draft: false
+type: security-advisory
+cve: CVE-2026-60093
+severity: MEDIUM
+summary: "Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir, so a name containing traversal segments could write outside that directory"
+description: "The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir endpoint option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) and passed the result straight to the SDK download call, with  [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed path name as a full-string match, so that only simple single- [...]
+credit: "Reported by n0mi1k and Hiep Nguyen"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23942 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24542 (commit 55fcbaf8bc1936cae90abdea5adecbc43e57340e) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24581 (commit 007929bb732a8c5e3e49d4d3c6c8adc2aab13340) and to camel-4.14.x in https://github.com/apache/camel/pull/24582 (commit 857d0cd3024b706ce80f3d2a4aa111e5e94a3e59). A follow-up documentation change, https://github.com/apache/camel/pull/24585 (commit 513d0e18a4b54220f6c12ab84d3bea9641f9776d [...]
+
+The fix resolves the remote path name against fileDir, normalizes the result lexically so that parent-directory segments are collapsed, and then verifies that the normalized target is still contained within the normalized fileDir on path-segment boundaries - so a sibling directory whose name merely extends fileDir as a string prefix is not treated as contained. A name that resolves outside the directory is rejected with an IllegalArgumentException before the Azure SDK download call is in [...]
diff --git a/content/security/CVE-2026-60093.txt.asc b/content/security/CVE-2026-60093.txt.asc
new file mode 100644
index 00000000..93d94297
--- /dev/null
+++ b/content/security/CVE-2026-60093.txt.asc
@@ -0,0 +1,35 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-60093"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-60093.html
+draft: false
+type: security-advisory
+cve: CVE-2026-60093
+severity: MEDIUM
+summary: "Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir, so a name containing traversal segments could write outside that directory"
+description: "The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir endpoint option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) and passed the result straight to the SDK download call, with  [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed path name as a full-string match, so that only simple single- [...]
+credit: "Reported by n0mi1k and Hiep Nguyen"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23942 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24542 (commit 55fcbaf8bc1936cae90abdea5adecbc43e57340e) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24581 (commit 007929bb732a8c5e3e49d4d3c6c8adc2aab13340) and to camel-4.14.x in https://github.com/apache/camel/pull/24582 (commit 857d0cd3024b706ce80f3d2a4aa111e5e94a3e59). A follow-up documentation change, https://github.com/apache/camel/pull/24585 (commit 513d0e18a4b54220f6c12ab84d3bea9641f9776d [...]
+
+The fix resolves the remote path name against fileDir, normalizes the result lexically so that parent-directory segments are collapsed, and then verifies that the normalized target is still contained within the normalized fileDir on path-segment boundaries - so a sibling directory whose name merely extends fileDir as a string prefix is not treated as contained. A name that resolves outside the directory is rejected with an IllegalArgumentException before the Azure SDK download call is in [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL47YACgkQ406fOAL/
+QQBfwgf/Zyd1eA8723Q4SoXRF/b9M/Vqk2lNf4pSLdQEOfQ5Z09syXNggMbqOus1
+8vOvzWCw5K54wLVn3v15gXe/A21Li/3jCFnbUjqOav8WWsdaqwvCZ39CdSnCXNf9
+ZGu94Ua7isCNBP4joBo9KI/DPd3CGo4Uj7bkLgJFdWFeMjAMF5KPIrTSE3txKprx
+gi+gjT8bwc+UNCxRneZ5cKU5LL5yBxtRbA0BeZ3P//0kZ6GFa/9fJgM6/gjANwPY
+BktDRRPlTPRNj/jyz4zsrybLA9pHu8N+uA1GaFEjvCOvWhx6TUYGNh6vpwmK2iaE
+oVDxmnnAWF/81x7dXM7Q8aIdp5huIg==
+=Uj2r
+-----END PGP SIGNATURE-----

(camel-website) 03/04: Added CVE-2026-66907

Posted by ac...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch CVE-more-sessions
in repository https://gitbox.apache.org/repos/asf/camel-website.git

commit b9ea312d56ca2e5bf52cf99d9ef13fbe48e29ebf
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Aug 24 09:55:04 2026 +0200

    Added CVE-2026-66907
    
    Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
 content/security/CVE-2026-66906.txt.asc | 16 +++++++--------
 content/security/CVE-2026-66907.md      | 21 ++++++++++++++++++++
 content/security/CVE-2026-66907.txt.asc | 35 +++++++++++++++++++++++++++++++++
 3 files changed, 64 insertions(+), 8 deletions(-)

diff --git a/content/security/CVE-2026-66906.txt.asc b/content/security/CVE-2026-66906.txt.asc
index 2c076d7a..8dd84f3e 100644
--- a/content/security/CVE-2026-66906.txt.asc
+++ b/content/security/CVE-2026-66906.txt.asc
@@ -24,12 +24,12 @@ The fix was merged on main in https://github.com/apache/camel/pull/24542 (commit
 The fix resolves the remote blob name against fileDir, normalizes the result lexically so that parent-directory segments are collapsed, and then verifies that the normalized target is still contained within the normalized fileDir on path-segment boundaries - so a sibling directory whose name merely extends fileDir as a string prefix is not treated as contained. A name that resolves outside the directory is rejected with an IllegalArgumentException before the Azure SDK download call is in [...]
 -----BEGIN PGP SIGNATURE-----
 
-iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL8ngACgkQ406fOAL/
-QQBtOgf9EhOykOpXaWJHNUfO86kGA/SdONzGNK4Mfsz83fe/7H7HCnyETM/cyHom
-uNxVkJ284K3aTOCtARwsGaa02GFTaIABLnFt1m897czjXsFvJB60fXWHF5Nk9u5O
-AUHiXvxJhO/yP+gKU4k7L6bW3YQtiUfSUDYelUHaDsrkPSEsaRC03t/ze8/TxUvr
-XYP9TS7cEmi9a+b9wvSJ/EFHUubecFZg13fiosPchuDAT9LiWy7QNn6pbp+IGnhz
-72oxHlFyP6YLIczzrwam5IS44JZJ+7v+euvO4FJZCwjYr9aa4zmrVynPf/rRU9KJ
-xzENdDG2Sv/8mFGxowxrVyyv1wg9BQ==
-=sYHf
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL+IAACgkQ406fOAL/
+QQC45wf9Hyg6cj9lvUdpLSdbcYcrjB/+EhHZ1Qz2eAHY/aLYzYoi/C53l2FqfU5f
+Yw1Fl8+6IQE209nMMTkPSWcfUiuYGvT2PWKYs5ZQRLrMDcp1Mwz8r0fLMrtWXVao
+wUkYvjNfHke9QfzDi5t+I6H73f1lxfATsVBzq1FuekB7ZfSkKHtUybrcQhz4/tnL
+RKyBYtBLE6BX5xdqxfU/HUXt5RhbRoFGaV/VED412IkNPzYyx/oujy2I6v+km0IC
+eSoB7tKUtUfrsIBbr/CBl9McGGmuyN/hliQUoI4hI8ibwcp9XryhC8jjuJ1NYv5A
+ob0W1wCOOg0YjdkZjFG0PN+sOu++yw==
+=8Y76
 -----END PGP SIGNATURE-----
diff --git a/content/security/CVE-2026-66907.md b/content/security/CVE-2026-66907.md
new file mode 100644
index 00000000..2b7d9af1
--- /dev/null
+++ b/content/security/CVE-2026-66907.md
@@ -0,0 +1,21 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-66907"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-66907.html
+draft: false
+type: security-advisory
+cve: CVE-2026-66907
+severity: MEDIUM
+summary: "Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result, so an object name containing traversal segments could write outside that directory"
+description: "The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + \"/${file:name}\". The ${file:name} token re [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segmen [...]
+credit: "Reported by n0mi1k"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24279 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/25179 (commit a6f73c6d2828fe2b76bf423bad92f98d80af7437) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25180 (commit 277ab7b7af9bd3beb789d458d54b00b704647191) and to camel-4.14.x in https://github.com/apache/camel/pull/25181 (commit 4b9b4ade15148e1512b39f302075b36c7a092e86). A follow-up documentation change, https://github.com/apache/camel/pull/25182 (commit 09d246d411cb2ba6bb1d7832e0c232056d955d34 [...]
+
+The fix adds a package-private GoogleCloudStorageFileNameHelper.assertWithinDirectory, which normalizes both the configured download directory and the resolved destination lexically so that parent-directory segments are collapsed, and then verifies that the destination is still contained within the directory on path-segment boundaries - so a sibling directory whose name merely extends the configured one as a string prefix is not treated as contained. A name that resolves outside the dire [...]
diff --git a/content/security/CVE-2026-66907.txt.asc b/content/security/CVE-2026-66907.txt.asc
new file mode 100644
index 00000000..c02ebc94
--- /dev/null
+++ b/content/security/CVE-2026-66907.txt.asc
@@ -0,0 +1,35 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-66907"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-66907.html
+draft: false
+type: security-advisory
+cve: CVE-2026-66907
+severity: MEDIUM
+summary: "Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result, so an object name containing traversal segments could write outside that directory"
+description: "The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + \"/${file:name}\". The ${file:name} token re [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segmen [...]
+credit: "Reported by n0mi1k"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24279 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/25179 (commit a6f73c6d2828fe2b76bf423bad92f98d80af7437) and backported to camel-4.18.x in https://github.com/apache/camel/pull/25180 (commit 277ab7b7af9bd3beb789d458d54b00b704647191) and to camel-4.14.x in https://github.com/apache/camel/pull/25181 (commit 4b9b4ade15148e1512b39f302075b36c7a092e86). A follow-up documentation change, https://github.com/apache/camel/pull/25182 (commit 09d246d411cb2ba6bb1d7832e0c232056d955d34 [...]
+
+The fix adds a package-private GoogleCloudStorageFileNameHelper.assertWithinDirectory, which normalizes both the configured download directory and the resolved destination lexically so that parent-directory segments are collapsed, and then verifies that the destination is still contained within the directory on path-segment boundaries - so a sibling directory whose name merely extends the configured one as a string prefix is not treated as contained. A name that resolves outside the dire [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL+IUACgkQ406fOAL/
+QQDV9wgAlkGfk5O5qYr18kw+ZOyGmQtg3HwX/ZA0LVU+9XGERZudhJbwxvERvids
+fOHAkHTs6YYG2izV/CePHK0zVn7MXIrmbQzg657ihN7XZ+EuVJTs/K4gcrSqgBMh
+mOp1Dgm+jjWLjeGEnzKCtVZ50R3QlDUhwHVWNCylLRxW6t6JThD9XBqp6hwbOPO7
+8wvxRzmOBtyuhtDxzsUVFpQEqbv/Gj4PL5d3KPhjJxf3edQ3Nf+2PIAPHzPFGbjP
+9JIODpHL1npiJHTIWkQwW60JKwOsJkygTqwvpKgCn6fYWzwLV0iNVk0uPXIP2tAy
+cJFN+j/BF5WD3lrMZ58JMAr2zFGRyw==
+=opEV
+-----END PGP SIGNATURE-----

(camel-website) 02/04: Added CVE CVE-2026-66906

Posted by ac...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch CVE-more-sessions
in repository https://gitbox.apache.org/repos/asf/camel-website.git

commit 76850d8dbb2aa42f31da7448321f8d930ed6cddc
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Aug 24 09:29:44 2026 +0200

    Added CVE CVE-2026-66906
    
    Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
 content/security/CVE-2026-66906.md      | 21 ++++++++++++++++++++
 content/security/CVE-2026-66906.txt.asc | 35 +++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/content/security/CVE-2026-66906.md b/content/security/CVE-2026-66906.md
new file mode 100644
index 00000000..397c8f16
--- /dev/null
+++ b/content/security/CVE-2026-66906.md
@@ -0,0 +1,21 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-66906"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-66906.html
+draft: false
+type: security-advisory
+cve: CVE-2026-66906
+severity: MEDIUM
+summary: "Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir, so a name containing traversal segments could write outside that directory"
+description: "The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single- [...]
+credit: "Reported by n0mi1k and Hiep Nguyen"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23942 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24542 (commit 55fcbaf8bc1936cae90abdea5adecbc43e57340e) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24581 (commit 007929bb732a8c5e3e49d4d3c6c8adc2aab13340) and to camel-4.14.x in https://github.com/apache/camel/pull/24582 (commit 857d0cd3024b706ce80f3d2a4aa111e5e94a3e59). A follow-up documentation change, https://github.com/apache/camel/pull/24585 (commit 513d0e18a4b54220f6c12ab84d3bea9641f9776d [...]
+
+The fix resolves the remote blob name against fileDir, normalizes the result lexically so that parent-directory segments are collapsed, and then verifies that the normalized target is still contained within the normalized fileDir on path-segment boundaries - so a sibling directory whose name merely extends fileDir as a string prefix is not treated as contained. A name that resolves outside the directory is rejected with an IllegalArgumentException before the Azure SDK download call is in [...]
diff --git a/content/security/CVE-2026-66906.txt.asc b/content/security/CVE-2026-66906.txt.asc
new file mode 100644
index 00000000..2c076d7a
--- /dev/null
+++ b/content/security/CVE-2026-66906.txt.asc
@@ -0,0 +1,35 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-66906"
+date: 2026-08-24T10:00:00+02:00
+url: /security/CVE-2026-66906.html
+draft: false
+type: security-advisory
+cve: CVE-2026-66906
+severity: MEDIUM
+summary: "Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir, so a name containing traversal segments could write outside that directory"
+description: "The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result [...]
+mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single- [...]
+credit: "Reported by n0mi1k and Hiep Nguyen"
+affected: "From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0."
+fixed: 4.14.9, 4.18.4 and 4.22.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23942 refers to the various commits that resolved the issue, and has more details.
+
+The fix was merged on main in https://github.com/apache/camel/pull/24542 (commit 55fcbaf8bc1936cae90abdea5adecbc43e57340e) and backported to camel-4.18.x in https://github.com/apache/camel/pull/24581 (commit 007929bb732a8c5e3e49d4d3c6c8adc2aab13340) and to camel-4.14.x in https://github.com/apache/camel/pull/24582 (commit 857d0cd3024b706ce80f3d2a4aa111e5e94a3e59). A follow-up documentation change, https://github.com/apache/camel/pull/24585 (commit 513d0e18a4b54220f6c12ab84d3bea9641f9776d [...]
+
+The fix resolves the remote blob name against fileDir, normalizes the result lexically so that parent-directory segments are collapsed, and then verifies that the normalized target is still contained within the normalized fileDir on path-segment boundaries - so a sibling directory whose name merely extends fileDir as a string prefix is not treated as contained. A name that resolves outside the directory is rejected with an IllegalArgumentException before the Azure SDK download call is in [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqL8ngACgkQ406fOAL/
+QQBtOgf9EhOykOpXaWJHNUfO86kGA/SdONzGNK4Mfsz83fe/7H7HCnyETM/cyHom
+uNxVkJ284K3aTOCtARwsGaa02GFTaIABLnFt1m897czjXsFvJB60fXWHF5Nk9u5O
+AUHiXvxJhO/yP+gKU4k7L6bW3YQtiUfSUDYelUHaDsrkPSEsaRC03t/ze8/TxUvr
+XYP9TS7cEmi9a+b9wvSJ/EFHUubecFZg13fiosPchuDAT9LiWy7QNn6pbp+IGnhz
+72oxHlFyP6YLIczzrwam5IS44JZJ+7v+euvO4FJZCwjYr9aa4zmrVynPf/rRU9KJ
+xzENdDG2Sv/8mFGxowxrVyyv1wg9BQ==
+=sYHf
+-----END PGP SIGNATURE-----