From d31efda554849e5956706a7d9ac332602f48665b Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Mon, 3 Aug 2026 13:10:56 +0200 Subject: [PATCH 1/2] Add BifroMQ threat model Adds a reference to the Apache BifroMQ security model to `security.apache.org`, and with it the first BifroMQ entry in the projects overview. Assisted-By: Claude Opus 5 (1M context) --- content/projects/_index.md | 7 +++++++ scripts/project-coordinates.json | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/content/projects/_index.md b/content/projects/_index.md index 3c968835..75ce30dc 100644 --- a/content/projects/_index.md +++ b/content/projects/_index.md @@ -160,6 +160,13 @@ Use the tabs below to jump to projects by their initial. Every project lists a s [security@apache.org](mailto:security@apache.org?subject=Beam) - Advisories (experimental):\ none so far +- **Apache BifroMQ** + - **Security contact:**\ + [security@apache.org](mailto:security@apache.org?subject=BifroMQ) + - Advisories (experimental):\ + none so far + - Security model: + - [Apache BifroMQ security model](https://bifromq.apache.org/docs/admin_guide/security/intro/) - **Apache Bigtop** - **Security contact:**\ [security@apache.org](mailto:security@apache.org?subject=Bigtop) diff --git a/scripts/project-coordinates.json b/scripts/project-coordinates.json index cacf1862..01dd3e1c 100644 --- a/scripts/project-coordinates.json +++ b/scripts/project-coordinates.json @@ -191,6 +191,14 @@ "contact": "security@apache.org", "logo_link": "https://www.apache.org/logos/res/beam/default.png" }, + "bifromq": { + "name": "Apache BifroMQ", + "security_model_link": "https://bifromq.apache.org/docs/admin_guide/security/intro/", + "security_model_source": "https://raw.githubusercontent.com/apache/bifromq-sites/master/docs/admin_guide/security/intro.md", + "advisory_link": null, + "contact": "security@apache.org", + "logo_link": null + }, "bigtop": { "name": "Apache Bigtop", "security_model_link": null, From 59297ecbbf00a72e3cea0d9cc7c2339fc8be6f8a Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Mon, 3 Aug 2026 13:10:56 +0200 Subject: [PATCH 2/2] Regenerate project pages Picks up the current CVE feed and project metadata: * Fluss has graduated, so it is no longer listed as "(Incubating)". * Refreshed "last updated" stamps on three Thrift advisories. * Drops CVE-2026-66713 from the Axis page. The record is still PUBLISHED at MITRE, but it is no longer present in https://cveprocess.apache.org/publicjson, which is what these pages are generated from. Assisted-By: Claude Opus 5 (1M context) --- content/projects/_index.md | 4 ++-- content/projects/axis/_index.md | 37 ------------------------------- content/projects/fluss/_index.md | 6 ++--- content/projects/thrift/_index.md | 6 ++--- 4 files changed, 8 insertions(+), 45 deletions(-) diff --git a/content/projects/_index.md b/content/projects/_index.md index 75ce30dc..01c379a4 100644 --- a/content/projects/_index.md +++ b/content/projects/_index.md @@ -454,9 +454,9 @@ Use the tabs below to jump to projects by their initial. Every project lists a s [flink.apache.org](https://flink.apache.org/what-is-flink/security/) - Security model: - [Apache Flink security model](https://flink.apache.org/what-is-flink/security/) -- **Apache Fluss (Incubating)** +- **Apache Fluss** - **Security contact:**\ - [security@apache.org](mailto:security@apache.org?subject=Fluss%20%28Incubating%29) + [security@apache.org](mailto:security@apache.org?subject=Fluss) - Advisories (experimental):\ [security.apache.org](/projects/fluss/) - **Apache Fory** diff --git a/content/projects/axis/_index.md b/content/projects/axis/_index.md index 750d53cb..1e84f7ca 100644 --- a/content/projects/axis/_index.md +++ b/content/projects/axis/_index.md @@ -20,43 +20,6 @@ You can read more about the security policy on: This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security pages linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org) {.bg-warning} -## deserialization of untrusted Data ## { #CVE-2026-66713 } - -CVE-2026-66713 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66713) [\[CVE json\]](./CVE-2026-66713.cve.json) [\[OSV json\]](./CVE-2026-66713.osv.json) - - - -_Last updated: 2026-07-28T13:44:22.395Z_ - -### Affected - -* Apache Axis2/Java through 2.0.0 - - -### Description - -Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component -
 in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat -
 (only when Tribes clustering is enabled, which is off by default) allows an -
 unauthenticated remote attacker with network access to the clustering port to -
 execute arbitrary code via a crafted serialized Java object delivered to the cluster -
 channel and deserialized in -
 org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are -
 recommended to upgrade to version 2.0.1, which fixes this issue by removing the -
 clustering feature entirely.
-
- -
- -### References -* https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15 -* https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728 - - -### Credits -* liuhuajin of Huawei (finder) - - ## Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API ## { #CVE-2023-51441 } CVE-2023-51441 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2023-51441) [\[CVE json\]](./CVE-2023-51441.cve.json) [\[OSV json\]](./CVE-2023-51441.osv.json) diff --git a/content/projects/fluss/_index.md b/content/projects/fluss/_index.md index 32d6f65e..a5ac8bd0 100644 --- a/content/projects/fluss/_index.md +++ b/content/projects/fluss/_index.md @@ -1,12 +1,12 @@ --- -title: Apache Fluss (Incubating) security advisories -description: Security information for Apache Fluss (Incubating) +title: Apache Fluss security advisories +description: Security information for Apache Fluss layout: single --- # Reporting -Do you want disclose a potential security issue for Apache Fluss (Incubating)? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss%20%28Incubating%29). +Do you want disclose a potential security issue for Apache Fluss? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss). # Advisories diff --git a/content/projects/thrift/_index.md b/content/projects/thrift/_index.md index cee36f2b..1f6391cc 100644 --- a/content/projects/thrift/_index.md +++ b/content/projects/thrift/_index.md @@ -387,7 +387,7 @@ CVE-2026-43870 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43870) [\[CVE jso -_Last updated: 2026-05-05T07:45:34.804Z_ +_Last updated: 2026-08-01T15:14:33.689Z_ ### Affected @@ -408,7 +408,7 @@ CVE-2026-43869 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43869) [\[CVE jso -_Last updated: 2026-05-05T07:25:46.713Z_ +_Last updated: 2026-08-01T15:15:50.815Z_ ### Affected @@ -476,7 +476,7 @@ CVE-2026-41608 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-41608) [\[CVE jso -_Last updated: 2026-07-27T10:53:37.845Z_ +_Last updated: 2026-08-01T15:15:08.921Z_ ### Affected