This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/main by this push:
new e2e8493c Added CVE-2026-43867 (#1688)
e2e8493c is described below
commit e2e8493cbbef816a936b8bc549341ac576e3ac80
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Jul 6 09:27:16 2026 +0200
Added CVE-2026-43867 (#1688)
Signed-off-by: Andrea Cosentino <[email protected]>
---
content/security/CVE-2026-43867.md | 17 +++++++++++++++++
content/security/CVE-2026-43867.txt.asc | 31 +++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/content/security/CVE-2026-43867.md
b/content/security/CVE-2026-43867.md
new file mode 100644
index 00000000..25e52c78
--- /dev/null
+++ b/content/security/CVE-2026-43867.md
@@ -0,0 +1,17 @@
+---
+title: "Apache Camel Security Advisory - CVE-2026-43867"
+date: 2026-07-05T10:00:00+02:00
+url: /security/CVE-2026-43867.html
+draft: false
+type: security-advisory
+cve: CVE-2026-43867
+severity: MEDIUM
+summary: "Camel-PQC: The AWS Secrets Manager key-lifecycle manager
deserializes persisted key metadata with java.io.ObjectInputStream and no
ObjectInputFilter (same defect as CVE-2026-46590, reported independently)"
+description: "The camel-pqc component persists post-quantum key metadata
(KeyMetadata) through pluggable KeyLifecycleManager implementations.
AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata
back from the configured AWS Secrets Manager secret by Base64-decoding the
stored value and deserializing it with a raw
java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class
allow-list; the cast to KeyMetadata happens only after readObject() returns, s
[...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes
the issue. If users are on the 4.18.x LTS releases stream, then they are
suggested to upgrade to 4.18.3. For deployments that cannot upgrade
immediately, restrict write access to the AWS Secrets Manager secret that holds
the camel-pqc key metadata so that only the application's own identity holds
secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key
material in a secret separate from an [...]
+credit: "This issue was discovered by Venkatraman Kumar from Securin"
+affected: "From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.18.3 and 4.21.0
+---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23726 refers to
the various commits that resolved the issue, and have more details. The fix was
merged on main in https://github.com/apache/camel/pull/23912 (commit
feea08e7847f35dc0e177652b0b02bd45f6c1b4f) and backported to camel-4.18.x in
https://github.com/apache/camel/pull/23914 (commit
12a9ac3c94d6fda12d16b2c0039db41c6204727e). The fix introduces a shared
KeyMetadataCodec that stores key metadata as JSON for all three KeyL [...]
diff --git a/content/security/CVE-2026-43867.txt.asc
b/content/security/CVE-2026-43867.txt.asc
new file mode 100644
index 00000000..cb6fb1db
--- /dev/null
+++ b/content/security/CVE-2026-43867.txt.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Security Advisory - CVE-2026-43867"
+date: 2026-07-05T10:00:00+02:00
+url: /security/CVE-2026-43867.html
+draft: false
+type: security-advisory
+cve: CVE-2026-43867
+severity: MEDIUM
+summary: "Camel-PQC: The AWS Secrets Manager key-lifecycle manager
deserializes persisted key metadata with java.io.ObjectInputStream and no
ObjectInputFilter (same defect as CVE-2026-46590, reported independently)"
+description: "The camel-pqc component persists post-quantum key metadata
(KeyMetadata) through pluggable KeyLifecycleManager implementations.
AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata
back from the configured AWS Secrets Manager secret by Base64-decoding the
stored value and deserializing it with a raw
java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class
allow-list; the cast to KeyMetadata happens only after readObject() returns, s
[...]
+mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes
the issue. If users are on the 4.18.x LTS releases stream, then they are
suggested to upgrade to 4.18.3. For deployments that cannot upgrade
immediately, restrict write access to the AWS Secrets Manager secret that holds
the camel-pqc key metadata so that only the application's own identity holds
secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key
material in a secret separate from an [...]
+credit: "This issue was discovered by Venkatraman Kumar from Securin"
+affected: "From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0."
+fixed: 4.18.3 and 4.21.0
+- ---
+
+The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23726 refers to
the various commits that resolved the issue, and have more details. The fix was
merged on main in https://github.com/apache/camel/pull/23912 (commit
feea08e7847f35dc0e177652b0b02bd45f6c1b4f) and backported to camel-4.18.x in
https://github.com/apache/camel/pull/23914 (commit
12a9ac3c94d6fda12d16b2c0039db41c6204727e). The fix introduces a shared
KeyMetadataCodec that stores key metadata as JSON for all three KeyL [...]
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmpLV1MACgkQ406fOAL/
+QQCPaAf9EWWjDWMehLdnKlkZCoK8P2tCWEzQvARHN02SLSq15n7vBP7hkjrXMKrV
+wwVhvJT6ybX+HL7KM3EXSbVf6bwTuwk67KLdftDZBU4Pvny/Vyb9CNL8fiaRm6+2
+Sp1lwzD3g02kR0n5BVDXP3BQ0yuhHR1Ju75x+FYJTd88xvIRi7437rr12Jsl1ixL
+4t6E3pHOFJoirxRStHhf0DoZhHTizcyN5Yj77eTiyRcMKVhg4DLR6WwR41hHoriW
+09R1Lkbxx7ge9ykl2BPu/bs1nKnwuOCvRvN0DS4uplVVUH4pi6YV6rBhBRFRhLuw
+iHuSTOXw1c6AqMKqHSu9bFKkQcygMQ==
+=Xkic
+-----END PGP SIGNATURE-----
