From 420ec2b0648cec8d4e7700891b7011cabf9f7f26 Mon Sep 17 00:00:00 2001 From: Austin Moody Date: Mon, 31 Aug 2026 09:19:02 -0400 Subject: [PATCH] fix(security): suppress camel JWT CVE, drop inert opentelemetry entry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-08-31 nightly failed its post-update CVE scan. The 7 camel CVEs fixed by 4.18.4 are gone; this is a new finding published since. CVE-2026-66908 (CVSS 7.5) is in the Apache Camel Platform HTTP Main component: the camel-main embedded HTTP server built Vert.x JWTAuth from the keystore alone when neither jwtIssuer nor jwtAudience was set, so inbound tokens were checked only for signature and expiry. See CAMEL-24281. No upgrade clears it on our line. The advisory is explicit: "This behaviour is fixed only on 4.22.0 ... The fail-closed guard could not be backported." 4.18.4 is the newest 4.18.x release. Camel 4.22.0 is not available to us. camel-spring-boot switched to Spring Boot 4 at 4.19.0: 4.19.0 and 4.20.0 resolve Spring Boot 4.0.5, 4.21.0 and 4.22.0 resolve Spring Boot 4.1.0 with Spring Framework 7.0.8. Pinning Spring Boot 3.5.16 underneath camel 4.22.0 resolves cleanly but does not run — camel-spring-boot-4.22.0.jar is compiled against Spring Boot 4 package locations that do not exist in 3.5.16: org.springframework.boot.EnvironmentPostProcessor -> 3.5.16 has org.springframework.boot.env.EnvironmentPostProcessor org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory -> 3.5.16 has org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory Both ship in the core spring-boot artifact, which is on the classpath at 3.5.16, so these are NoClassDefFoundError at startup, not unresolved optional jars. izgw-core, izgw-hub, izgw-transform and v2tofhir all take this BOM as parent and none declares its own spring-boot.version, so moving off 3.5.x is a coordinated four-repo major upgrade. Suppress with an expiry of 2027-02-28 to put a date on that decision. The vulnerable code is not on the classpath: camel-platform-http-main and io.vertx are absent from both the BOM validation tree and izgw-transform, and camel-main-4.18.4.jar carries no JWT, platform-http or Vert.x classes. Matched on alone. Per the suppression XSD, is a suppress-what element rather than a dependency selector, so keying on cpe:/a:apache:camel would have hidden every camel finding including future ones. Also remove the CVE-2026-54285 opentelemetry entry added in fa8bd73. It never matched: it was keyed on , but opentelemetry-api ships no META-INF/maven (the Java client builds with Gradle) so Dependency-Check derives no purl for it. Rather than re-key it, let the finding stand. At CVSS 5.3 it is below the --failOnCVSS 7 gate, so it never fails a build; it sets HAS_CVES, which labels the nightly PR "security" and leaves it for a human to merge. That is the intended behaviour of that gate. Verified: xmllint --schema dependency-suppression.1.3.xsd validates. Suppression matching itself is unverified locally — Dependency-Check needs the NVD database and an API key. Confirm with a workflow_dispatch run. --- dependency-suppression.xml | 50 ++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 16 deletions(-) diff --git a/dependency-suppression.xml b/dependency-suppression.xml index 830c6a4..aac0bc5 100644 --- a/dependency-suppression.xml +++ b/dependency-suppression.xml @@ -155,25 +155,43 @@ for the Java - jars with no target_sw, and the wildcard matches node.js, so every io.opentelemetry - Maven artifact below 2.8.0 matches. This project ships no Node OpenTelemetry. + CVE-2026-66908 is in the Apache Camel Platform HTTP Main component: the camel-main + embedded HTTP server built JWTAuth from the keystore alone when neither jwtIssuer nor + jwtAudience was set, so inbound tokens were checked only for signature and expiry + (JWTAuthenticationConfigurer.buildJwtOptions, Vert.x JWTAuth). See CAMEL-24281. - This cannot be cleared by upgrading. The Java API is on the 1.x line and the CPE range - is "up to (excluding) 2.8.0", so every current and foreseeable Java release matches. + That code is not on the classpath here. Verified on camel 4.18.4, in both the BOM + validation tree and izgw-transform: + - camel-platform-http-main : not resolved in either tree + - io.vertx : not resolved in either tree + - camel-main-4.18.4.jar : contains no JWT, platform-http or Vert.x classes + izgw-transform is a Spring Boot application using camel-spring-boot-starter. It never + starts camel-main's standalone HTTP server, and could not without Vert.x present. + Dependency-Check matches on version alone: cpe:2.3:a:apache:camel:* covers + "from 4.8.0 up to excluding 4.22.0" for every camel artifact, whatever the module. - packageUrl is used instead of sha1 so the entry survives an opentelemetry.version bump. - The element pins it to this one CVE, so no other io.opentelemetry finding is masked. + There is no upgrade that clears this on our line. Per the advisory: "This behaviour is + fixed only on 4.22.0 ... The fail-closed guard could not be backported. The jwtIssuer + and jwtAudience options were themselves only introduced in 4.21.0 by CAMEL-23525, so on + camel-4.18.x and camel-4.14.x there was nothing an operator could set to satisfy the + requirement." 4.18.4 is the newest 4.18.x release, and camel 4.22.0 requires Spring + Boot 4.1 / Spring Framework 7 while this BOM pins spring-boot.version on 3.5.x. The real + remediation is the Spring Boot 4 plus Camel 4.22 upgrade. See versions-rules.xml for the + cap that keeps automation on 4.18.x until then. - Expires 2027-02-28. On that date the finding returns and the nightly PR is labelled - "security" and left unmerged. Re-check whether NVD has corrected the CPE to enforce - target_sw; if it has, delete this entry, otherwise extend the date. - Added: 2026-08-28 + Matched on alone, with no dependency selector, so it applies wherever this one CVE + is raised. Do not add cpe:/a:apache:camel: per the suppression XSD is a + suppress-what element, not a dependency selector, so it would hide every Camel finding + including future ones. + + WARNING - read before changing the date. This CVE is CVSS 7.5, at or above the + --failOnCVSS 7 gate used by both dependency-updates.yml and publish.yml. When this + suppression expires the scan fails hard: the nightly exits 1 with no PR, and publish.yml + exits 1 so develop stops deploying to GitHub Packages. Recovery needs an edit to this + file. The expiry is deliberate, to force the upgrade decision rather than let it drift, + but it must be tracked so it does not land unattended. + Expires 2027-02-28. Added: 2026-08-31 ]]> - ^pkg:maven/io\.opentelemetry/.*$ - CVE-2026-54285 + CVE-2026-66908