This is an automated email from the ASF dual-hosted git repository. davsclaus pushed a commit to branch backport/25622-to-camel-4.18.x in repository https://gitbox.apache.org/repos/asf/camel.git
commit 7fe80d30368ffcb0cfa577b326a8ea6b667f2ef5 Author: Ivona Cvija <[email protected]> AuthorDate: Tue Aug 25 08:13:53 2026 +0100 Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 (#25622) apacheds-core-api transitively pulls org.apache.directory.api 2.1.5, which is affected by CVE-2026-35563. ApacheDS is dormant and will not release a fix, but Apache Directory API 2.1.8 remediates it. This excludes org.apache.directory.api from the apacheds-* dependencies (camel-ldif compile scope, camel-ldap test scope) and re-declares the required artifacts at a new central directory-api-version=2.1.8 property, avoiding any 2.1.5/2.1.8 version skew. Closes #25622 --- components/camel-ldap/pom.xml | 52 +++++++++++++++++++++++++++++++++++++++++++ components/camel-ldif/pom.xml | 50 +++++++++++++++++++++++++++++++++++++++++ parent/pom.xml | 1 + 3 files changed, 103 insertions(+) diff --git a/components/camel-ldap/pom.xml b/components/camel-ldap/pom.xml index eab7d0962b67..c05d3ebef92b 100644 --- a/components/camel-ldap/pom.xml +++ b/components/camel-ldap/pom.xml @@ -52,6 +52,12 @@ <artifactId>apacheds-server-jndi</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.directory.server</groupId> @@ -63,6 +69,10 @@ <groupId>log4j</groupId> <artifactId>log4j</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> </dependency> <dependency> @@ -70,6 +80,12 @@ <artifactId>apacheds-core-integ</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.mina</groupId> @@ -77,5 +93,41 @@ <version>${mina-version}</version> <scope>test</scope> </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-client-api</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-util</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-codec-standalone</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-sp</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-dsml-engine</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-trigger</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> </dependencies> </project> diff --git a/components/camel-ldif/pom.xml b/components/camel-ldif/pom.xml index becd1b9e65bf..ad97783ef17e 100644 --- a/components/camel-ldif/pom.xml +++ b/components/camel-ldif/pom.xml @@ -53,8 +53,48 @@ <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> </dependency> + <!-- Pin org.apache.directory.api transitively brought in by apacheds-core-api + (dormant, no release with the fix) to remediate CVE-2026-35563 --> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-client-api</artifactId> + <version>${directory-api-version}</version> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-util</artifactId> + <version>${directory-api-version}</version> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-codec-standalone</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-sp</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-dsml-engine</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.apache.directory.api</groupId> + <artifactId>api-ldap-extras-trigger</artifactId> + <version>${directory-api-version}</version> + <scope>test</scope> + </dependency> <!-- test dependencies --> <dependency> @@ -71,6 +111,10 @@ <groupId>log4j</groupId> <artifactId>log4j</artifactId> </exclusion> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> </exclusions> <scope>test</scope> </dependency> @@ -79,6 +123,12 @@ <artifactId>apacheds-core-integ</artifactId> <version>${apacheds-version}</version> <scope>test</scope> + <exclusions> + <exclusion> + <groupId>org.apache.directory.api</groupId> + <artifactId>*</artifactId> + </exclusion> + </exclusions> </dependency> <dependency> <groupId>org.apache.mina</groupId> diff --git a/parent/pom.xml b/parent/pom.xml index 5a390631281c..90bb290740ef 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -149,6 +149,7 @@ <derby-version>10.16.1.1</derby-version> <dhis2-version>3.0.2</dhis2-version> <digitalocean-api-client-version>2.17</digitalocean-api-client-version> + <directory-api-version>2.1.8</directory-api-version> <directory-watcher-version>0.19.1</directory-watcher-version> <disruptor-version>3.4.4</disruptor-version> <dnsjava-version>3.6.4</dnsjava-version>
