This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new 4113ee5472dd [backport camel-4.18.x] Pin org.apache.directory.api
artifacts to 2.1.8 to remediate CVE-2026-35563 (#25646)
4113ee5472dd is described below
commit 4113ee5472ddf309e1b7018bdfa6230a4cb57e20
Author: Claus Ibsen <[email protected]>
AuthorDate: Tue Aug 25 11:02:54 2026 +0200
[backport camel-4.18.x] Pin org.apache.directory.api artifacts to 2.1.8 to
remediate CVE-2026-35563 (#25646)
Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563
(#25622)
apacheds-core-api transitively pulls org.apache.directory.api 2.1.5, which
is affected by CVE-2026-35563. ApacheDS is dormant and will not release a fix,
but Apache Directory API 2.1.8 remediates it. This excludes
org.apache.directory.api from the apacheds-* dependencies (camel-ldif compile
scope, camel-ldap test scope) and re-declares the required artifacts at a new
central directory-api-version=2.1.8 property, avoiding any 2.1.5/2.1.8 version
skew.
Closes #25622
Co-authored-by: Ivona Cvija <[email protected]>
---
components/camel-ldap/pom.xml | 52 +++++++++++++++++++++++++++++++++++++++++++
components/camel-ldif/pom.xml | 50 +++++++++++++++++++++++++++++++++++++++++
parent/pom.xml | 1 +
3 files changed, 103 insertions(+)
diff --git a/components/camel-ldap/pom.xml b/components/camel-ldap/pom.xml
index eab7d0962b67..c05d3ebef92b 100644
--- a/components/camel-ldap/pom.xml
+++ b/components/camel-ldap/pom.xml
@@ -52,6 +52,12 @@
<artifactId>apacheds-server-jndi</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.directory.server</groupId>
@@ -63,6 +69,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -70,6 +80,12 @@
<artifactId>apacheds-core-integ</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.mina</groupId>
@@ -77,5 +93,41 @@
<version>${mina-version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-client-api</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-util</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-codec-standalone</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-sp</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-dsml-engine</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-trigger</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
</dependencies>
</project>
diff --git a/components/camel-ldif/pom.xml b/components/camel-ldif/pom.xml
index becd1b9e65bf..ad97783ef17e 100644
--- a/components/camel-ldif/pom.xml
+++ b/components/camel-ldif/pom.xml
@@ -53,8 +53,48 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
+ <!-- Pin org.apache.directory.api transitively brought in by
apacheds-core-api
+ (dormant, no release with the fix) to remediate CVE-2026-35563 -->
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-client-api</artifactId>
+ <version>${directory-api-version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-util</artifactId>
+ <version>${directory-api-version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-codec-standalone</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-sp</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-dsml-engine</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-trigger</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
<!-- test dependencies -->
<dependency>
@@ -71,6 +111,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
<scope>test</scope>
</dependency>
@@ -79,6 +123,12 @@
<artifactId>apacheds-core-integ</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.mina</groupId>
diff --git a/parent/pom.xml b/parent/pom.xml
index 5a390631281c..90bb290740ef 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -149,6 +149,7 @@
<derby-version>10.16.1.1</derby-version>
<dhis2-version>3.0.2</dhis2-version>
<digitalocean-api-client-version>2.17</digitalocean-api-client-version>
+ <directory-api-version>2.1.8</directory-api-version>
<directory-watcher-version>0.19.1</directory-watcher-version>
<disruptor-version>3.4.4</disruptor-version>
<dnsjava-version>3.6.4</dnsjava-version>
