Deserialization Of Untrusted Object

Apache Karaf is vulnerable to deserialization of untrusted data. The vulnerability exists in doStart function of Activator.java because the credentials are not being filtered which allows an attacker to send malicious inputs...