This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 8235fd8c0037be2bca2804fc690a037f561f0ecc Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Sep 7 17:02:34 2026 +0200 Correct the affected range in CVE-2026-78162 The advisory page said the range started at 4.15.0 while its CVE record said 4.0.0. camel-hazelcast first shipped in 2.7.0, so the wider value is the correct one; the page and the record now agree on 4.0.0. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01FdAMYBMwkMYCNYVQ9T37um Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-78162.md | 2 +- content/security/CVE-2026-78162.txt.asc | 154 +++++++------------------------- 2 files changed, 32 insertions(+), 124 deletions(-) diff --git a/content/security/CVE-2026-78162.md b/content/security/CVE-2026-78162.md index 13acda12..d2592188 100644 --- a/content/security/CVE-2026-78162.md +++ b/content/security/CVE-2026-78162.md @@ -10,7 +10,7 @@ summary: "Camel-Hazelcast: Incomplete fix for CVE-2026-43865 leaves managed inst description: "The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without ca [...] mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] credit: "This issue was discovered by cattier from TCBS and Leon Zlobecki" -affected: "From 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1." +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." fixed: 4.18.5, 4.22.1 and 4.23.0 --- diff --git a/content/security/CVE-2026-78162.txt.asc b/content/security/CVE-2026-78162.txt.asc index 0877e13d..fab47851 100644 --- a/content/security/CVE-2026-78162.txt.asc +++ b/content/security/CVE-2026-78162.txt.asc @@ -1,129 +1,37 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -Apache Camel security advisory: CVE-2026-78162 - -Project: Apache Camel -CVE ID: CVE-2026-78162 - -Severity - -MEDIUM - -Summary - -Camel-Hazelcast: Incomplete fix for CVE-2026-43865 leaves managed instances -without a Java deserialization filter, enabling remote code execution - -Versions affected - -- From 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. - -Versions fixed - -4.18.5, 4.22.1 and 4.23.0 - -Description - -The camel-hazelcast component applies a default Hazelcast -JavaSerializationFilterConfig to the instances it creates from its own -configuration, a protection introduced by CVE-2026-43865. That change did not -reach two of the configuration paths Camel builds itself, so those paths -continued to create Hazelcast instances whose Java deserialization is -unrestricted. - -ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository -but overrides doStart() without calling super.doStart(), keeping its own copy of -the bootstrap block, and therefore never received the filter: a route using it -without supplying a hazelcastInstance starts a Hazelcast member that -deserializes values read from the backing ReplicatedMap with no class -restriction. - -HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own -ClientConfig when hazelcastMode=client is selected and neither a referenced -ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, -so client-mode endpoints behaved differently from node-mode endpoints for an -otherwise identical configuration. - -In both cases an attacker able to publish into the Hazelcast cluster that the -affected instance is attached to can cause a serialized Java object of their -choosing to be deserialized inside Hazelcast's own serialization layer, before -Camel processes the exchange, resulting in remote code execution. Hazelcast -clusters have neither authentication nor TLS enabled by default. Selecting -client mode is a topology choice rather than a security option, so neither path -required the deployment to opt in to unsafe behaviour. - -Notes - -The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-24413 and -https://issues.apache.org/jira/browse/CAMEL-24420 refer to the various commits -that resolved the issue, and have more details. - -CAMEL-24413 covers ReplicatedHazelcastAggregationRepository and was merged on -main in https://github.com/apache/camel/pull/25566 (commit -27836f4c17ed8cf33f1ef4dff9daed903b1b8907). CAMEL-24420 covers the ClientConfig -that Camel builds for hazelcastMode=client endpoints and was merged on main in -https://github.com/apache/camel/pull/25595 (commit -07318cfe7e07379a6155117d9c2cf27e99af4687). Both were backported together to -camel-4.22.x in https://github.com/apache/camel/pull/25599 (commit -02a864ba28f80bf8076f00aa2094c46377a74f43) and to camel-4.18.x in -https://github.com/apache/camel/pull/25600 (commit -aea69111dc3ff1f8a32271fc95632aee32eb3f37). The fix adds an -applyDefault(ClientConfig) overload to HazelcastSerializationFilterHelper and -calls the helper on both previously uncovered paths, so every Hazelcast -configuration that Camel builds itself now carries the default filter, while a -user-supplied Config, ClientConfig or HazelcastInstance is still left untouched. - -This advisory is an incomplete-fix follow-on to CVE-2026-43865 (CAMEL-23414), -which introduced HazelcastSerializationFilterHelper and applied the default -filter to four of the six Camel-built configuration sites. The two sites -described above were not covered by that change, so deployments that upgraded to -4.14.8, 4.18.3 or 4.21.0 in response to that advisory remained exposed through -them. This issue is distinct from the Hazelcast library deserialization -advisories CVE-2016-10750 and CVE-2022-36418, which concern Hazelcast's own -code; this advisory concerns Apache Camel not applying the deserialization -protections that Hazelcast provides. It belongs to the same Camel -deserialization-hardening family as CVE-2026-25747 and CVE-2026-43865, and is -classified as CWE-502 (Deserialization of Untrusted Data). - -Releases from 4.0.0 through the 4.14.x line are affected as well, since -ReplicatedHazelcastAggregationRepository has carried the defect since it was -introduced, but those release lines reached end of life before this issue was -resolved and no fix will be issued for them. The affected ranges above therefore -start at the two supported streams. - -Mitigation - -Users are recommended to upgrade to version 4.23.0, which fixes the issue. If -users are on the 4.22.x releases stream, then they are suggested to upgrade to -4.22.1. If users are on the 4.18.x releases stream, then they are suggested to -upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life -before this issue was resolved and will not receive a fix, so deployments on -those lines must move to a supported release. - -For deployments that cannot upgrade immediately, supply an explicit Hazelcast -configuration carrying a JavaSerializationFilterConfig, or inject a pre-built -HazelcastInstance, since a user-supplied configuration is never overwritten by -Camel. Alternatively set the JVM-wide filter -- -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable -Hazelcast cluster authentication and TLS to restrict who can reach the cluster. - -Credit - -This issue was discovered by cattier from TCBS and Leon Zlobecki - -References - -PGP signed advisory data: CVE-2026-78162.txt.asc -Mitre CVE Entry: https://www.cve.org/CVERecord?id=CVE-2026-78162 +- --- +title: "Apache Camel Security Advisory - CVE-2026-78162" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-78162.html +draft: false +type: security-advisory +cve: CVE-2026-78162 +severity: MEDIUM +summary: "Camel-Hazelcast: Incomplete fix for CVE-2026-43865 leaves managed instances without a Java deserialization filter, enabling remote code execution" +description: "The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without ca [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] +credit: "This issue was discovered by cattier from TCBS and Leon Zlobecki" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-24413 and https://issues.apache.org/jira/browse/CAMEL-24420 refer to the various commits that resolved the issue, and have more details. + +CAMEL-24413 covers ReplicatedHazelcastAggregationRepository and was merged on main in https://github.com/apache/camel/pull/25566 (commit 27836f4c17ed8cf33f1ef4dff9daed903b1b8907). CAMEL-24420 covers the ClientConfig that Camel builds for hazelcastMode=client endpoints and was merged on main in https://github.com/apache/camel/pull/25595 (commit 07318cfe7e07379a6155117d9c2cf27e99af4687). Both were backported together to camel-4.22.x in https://github.com/apache/camel/pull/25599 (commit 02a [...] + +This advisory is an incomplete-fix follow-on to CVE-2026-43865 (CAMEL-23414), which introduced HazelcastSerializationFilterHelper and applied the default filter to four of the six Camel-built configuration sites. The two sites described above were not covered by that change, so deployments that upgraded to 4.14.8, 4.18.3 or 4.21.0 in response to that advisory remained exposed through them. This issue is distinct from the Hazelcast library deserialization advisories CVE-2016-10750 and CVE [...] + +Releases from 4.0.0 through the 4.14.x line are affected as well, since ReplicatedHazelcastAggregationRepository has carried the defect since it was introduced, but those release lines reached end of life before this issue was resolved and no fix will be issued for them. The affected ranges above therefore start at the two supported streams. -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqeb0UACgkQ406fOAL/ -QQCvbAgApyTo6DWwlDxdqc5j6nEH6nhfs/xl9ErECmxcjLMrEtta6O0CXYb8gZmZ -JWhBLv9yDufThpVLLDTkx/cRB8hACSLgkEde12NbWKe52q3sPv/Fp/6/rYYC4gW6 -Dc+WUNVkT3nSwWCT8aDaQ1Ggh2R5a0RZ5jFwHNjJ4ZqB7EQGGrp8/0Cxjh+w6x4y -4Sl7IkqFd63y8fUVwwh2M3CcatGzmVa/nKitUxWSr4ENUyU40nKRvXtRYhjiZxgk -n8ORZ4BCkGR0+IXrIw6u4LSdDi1AD1b9oPsTbQ/Fx53D2ykFEn5MPOdWBYWeCZCj -Rd7w/TD4qCcON3bAKp+OfRM/D8LuaA== -=8aZx +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqe0foACgkQ406fOAL/ +QQDPCAgAtasbi1FY/eSRh3orKToijpxfLQwJ3W16AOjqwslpG2rUdYlfHghJ+TRa +hVQcTkikDa4W4EugI8uLJdtSF3iPhh04d1SOz+LuBwBn5WMDA0nKb2cAJIqZ9jS1 +QLji49H8N3dFPY9A0Zr+IUyGSu4QaCfIEfQEu2+NtmGZ52nYpSexC94RbVJjJy++ +Fu7IUdnYL+VKtYpHiB7iixbsgU0z8NWj1Hyf7RwYFCT0rN68hiKtIk0rs/20R1F0 +XUgxOA02IPfdVe58hoSiRZdi2jrkfZBjeddK8GywAwgHQtPumSPS5L1EV53TD3rw +5KrCCoW1sISN0WUyJPR85VRZYrBVYg== +=AhaJ -----END PGP SIGNATURE-----
