This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.22.x by this push:
new 28b4a3fd7f9f Pin org.apache.directory.api artifacts to 2.1.8 to
remediate CVE-2026-35563 (4.22.x backport)
28b4a3fd7f9f is described below
commit 28b4a3fd7f9f3088fd1231fec740c8f1b25e524a
Author: Claus Ibsen <[email protected]>
AuthorDate: Tue Aug 25 13:23:06 2026 +0200
Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563
(4.22.x backport)
Backport of #25622 to the camel-4.22.x maintenance branch.
apacheds-core-api transitively pulls org.apache.directory.api 2.1.5,
affected by
CVE-2026-35563. ApacheDS is dormant and will not release a fix, but Apache
Directory
API 2.1.8 remediates it. This excludes org.apache.directory.api from the
apacheds-*
dependencies (camel-ldif compile scope, camel-ldap test scope) and
re-declares the
required artifacts at a new central directory-api-version=2.1.8 property,
avoiding any
2.1.5/2.1.8 version skew.
Cherry-picked cleanly from main.
Closes #25644
Co-authored-by: Ivona Cvija <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
---
components/camel-ldap/pom.xml | 52 +++++++++++++++++++++++++++++++++++++++++++
components/camel-ldif/pom.xml | 50 +++++++++++++++++++++++++++++++++++++++++
parent/pom.xml | 1 +
3 files changed, 103 insertions(+)
diff --git a/components/camel-ldap/pom.xml b/components/camel-ldap/pom.xml
index e2e2e11dffc4..64144fd5ec2f 100644
--- a/components/camel-ldap/pom.xml
+++ b/components/camel-ldap/pom.xml
@@ -52,6 +52,12 @@
<artifactId>apacheds-server-jndi</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.directory.server</groupId>
@@ -63,6 +69,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -70,6 +80,12 @@
<artifactId>apacheds-core-integ</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.mina</groupId>
@@ -77,5 +93,41 @@
<version>${mina-version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-client-api</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-util</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-codec-standalone</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-sp</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-dsml-engine</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-trigger</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
</dependencies>
</project>
diff --git a/components/camel-ldif/pom.xml b/components/camel-ldif/pom.xml
index 929e239e4e33..6d3116c297a4 100644
--- a/components/camel-ldif/pom.xml
+++ b/components/camel-ldif/pom.xml
@@ -53,8 +53,48 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
+ <!-- Pin org.apache.directory.api transitively brought in by
apacheds-core-api
+ (dormant, no release with the fix) to remediate CVE-2026-35563 -->
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-client-api</artifactId>
+ <version>${directory-api-version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-util</artifactId>
+ <version>${directory-api-version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-codec-standalone</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-sp</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-dsml-engine</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>api-ldap-extras-trigger</artifactId>
+ <version>${directory-api-version}</version>
+ <scope>test</scope>
+ </dependency>
<!-- test dependencies -->
<dependency>
@@ -71,6 +111,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
<scope>test</scope>
</dependency>
@@ -79,6 +123,12 @@
<artifactId>apacheds-core-integ</artifactId>
<version>${apacheds-version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.directory.api</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.mina</groupId>
diff --git a/parent/pom.xml b/parent/pom.xml
index 61eabcdf3aa3..e0045e2e33cc 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -141,6 +141,7 @@
<debezium-mysql-connector-version>26.7.0</debezium-mysql-connector-version>
<dhis2-version>3.0.2</dhis2-version>
<digitalocean-api-client-version>2.17</digitalocean-api-client-version>
+ <directory-api-version>2.1.8</directory-api-version>
<directory-watcher-version>0.19.1</directory-watcher-version>
<disruptor-version>3.4.4</disruptor-version>
<dnsjava-version>3.6.5</dnsjava-version>
