This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 59e154631d85f4db390a673c9aa8bd2666be2786 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:43 2026 +0200 Added CVE-2026-85317 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85317.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85317.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85317.md b/content/security/CVE-2026-85317.md new file mode 100644 index 00000000..7cbd86e3 --- /dev/null +++ b/content/security/CVE-2026-85317.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85317" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85317.html +draft: false +type: security-advisory +cve: CVE-2026-85317 +severity: MEDIUM +summary: "Camel-HTTP: OAuth2 token confusion - the JVM-global token cache was keyed on fewer fields than shape the token, so an endpoint could be served a cached token minted for a different scope, resource or token endpoint" +description: "The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token was obtained from. Two endpoints differing only in those fields therefore shared a cache entry, and an endpoint could be served a token minted for a different scope, a different resource, or by a different authorization server. The consequence is a request [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The cache key now includes every field that shapes the token, so entries are no longer shared between endpoints that differ in any of them. For deployments that cannot upgrade immediately, run endpoints that differ in scope, resource indicator or token endpoint in separate JVMs so that they [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24456 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25834 (commit 4e2ddabd0392441b48ce591105851933b04b34b0), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-524 Use of Cache Containing Sensitive Information. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85317.txt.asc b/content/security/CVE-2026-85317.txt.asc new file mode 100644 index 00000000..3b008f6c --- /dev/null +++ b/content/security/CVE-2026-85317.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85317" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85317.html +draft: false +type: security-advisory +cve: CVE-2026-85317 +severity: MEDIUM +summary: "Camel-HTTP: OAuth2 token confusion - the JVM-global token cache was keyed on fewer fields than shape the token, so an endpoint could be served a cached token minted for a different scope, resource or token endpoint" +description: "The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token was obtained from. Two endpoints differing only in those fields therefore shared a cache entry, and an endpoint could be served a token minted for a different scope, a different resource, or by a different authorization server. The consequence is a request [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The cache key now includes every field that shapes the token, so entries are no longer shared between endpoints that differ in any of them. For deployments that cannot upgrade immediately, run endpoints that differ in scope, resource indicator or token endpoint in separate JVMs so that they [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24456 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25834 (commit 4e2ddabd0392441b48ce591105851933b04b34b0), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-524 Use of Cache Containing Sensitive Information. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrcACgkQ406fOAL/ +QQC/zggAvHpqdWUdID/fGSNALVD/3EcMWEmcSoJfKb7e6z2LJTbBdaJRnDL0VdOJ +3rjkTH6kEDj8XE78ZAtz4g1aJver9D/BVkVsKKGlcGE32VpQiyOL5/e9Kkh1qGvV +tXhIFrLFQYkKbhfqe6R+J0kpCPJBpttRRA9PBeuIDs96xG4AIculgmM5WfW0+o49 +1ENibyBvTzECZ6BCxOqC7KF3qzNCHrzU3i11nlRb9vyaOAABHjpeihVKARzpyU47 +dhUgnX2RlRZxXSLqwVJgH3cib9eoj7pYFYFxuS4igwTQ2D+yFe0qiBsirAhESP0K +o7xN92OG7+hmOQBtXP7aadEk2zLCQw== +=iq1a +-----END PGP SIGNATURE-----
