From 7c1569b875271d9c6dac1fcb5426ff14d4a38a83 Mon Sep 17 00:00:00 2001
From: Andrea Cosentino <ancosen@gmail.com>
Date: Fri, 10 Jul 2026 09:24:41 +0200
Subject: [PATCH] Improve GHSA-w2v8-8q6c-3rhr

---
 .../GHSA-w2v8-8q6c-3rhr.json                  | 67 ++++++++++++++++++-
 1 file changed, 65 insertions(+), 2 deletions(-)

diff --git a/advisories/unreviewed/2026/07/GHSA-w2v8-8q6c-3rhr/GHSA-w2v8-8q6c-3rhr.json b/advisories/unreviewed/2026/07/GHSA-w2v8-8q6c-3rhr/GHSA-w2v8-8q6c-3rhr.json
index 28ea825380e36..cb8b67e86b5b4 100644
--- a/advisories/unreviewed/2026/07/GHSA-w2v8-8q6c-3rhr/GHSA-w2v8-8q6c-3rhr.json
+++ b/advisories/unreviewed/2026/07/GHSA-w2v8-8q6c-3rhr/GHSA-w2v8-8q6c-3rhr.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w2v8-8q6c-3rhr",
-  "modified": "2026-07-06T21:30:37Z",
+  "modified": "2026-07-06T21:31:44Z",
   "published": "2026-07-06T09:30:30Z",
   "aliases": [
     "CVE-2026-56140"
   ],
+  "summary": "Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components; because camel-aws2-sns is producer-only (no consumer) there is no reachable inbound header-injection path, so this is a defense-in-depth hardening change related to the camel-aws2-sqs issue CVE-2026-46456",
   "details": "Improper Input Validation vulnerability in Apache Camel AWS SNS component.\n\n\nThe camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns.\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nThis is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.",
   "severity": [
     {
@@ -13,7 +14,65 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.camel:camel-aws2-sns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 4.14.8"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.camel:camel-aws2-sns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 4.18.3"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.camel:camel-aws2-sns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 4.21.0"
+      }
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -22,6 +81,10 @@
     {
       "type": "WEB",
       "url": "https://camel.apache.org/security/CVE-2026-56140.html"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/camel/tree/main/components/camel-aws/camel-aws2-sns"
     }
   ],
   "database_specific": {