org.apache.karaf.demos:web (2.1.4), org.apache.karaf.tooling:org.apache.karaf.tooling.testing (2.1.4) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.1.4)

org.apache.karaf:apache-karaf MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web 2.1.4 - org.apache.karaf.tooling:org.apache.karaf.tooling.testing 2.1.4 -...

org.apache.karaf.demos:web (2.1.5), org.apache.karaf.tooling:org.apache.karaf.tooling.testing (2.1.5) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.1.5)

org.apache.karaf:apache-karaf MAVEN version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web 2.1.5 - org.apache.karaf.tooling:org.apache.karaf.tooling.testing 2.1.5 -...

org.apache.karaf.demos:web (2.1.6), org.apache.karaf.tooling:org.apache.karaf.tooling.testing (2.1.6) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.1.6)

org.apache.karaf:apache-karaf MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web 2.1.6 - org.apache.karaf.tooling:org.apache.karaf.tooling.testing 2.1.6 -...

org.apache.karaf.cellar:org.apache.karaf.cellar.itests (2.2.3), org.apache.karaf.demos:web (2.2.5) +4 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.2.5)

org.apache.karaf:apache-karaf MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.cellar:org.apache.karaf.cellar.itests 2.2.3 - org.apache.karaf.demos:web 2.2.5 -...

org.apache.jclouds.cli:jclouds-cli-assembly (>=1.6.1-incubating, <=1.8.1), org.apache.jclouds.karaf:itests (>=1.6.1-incubating, <=1.7.3) +6 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.2.7)

org.apache.karaf:apache-karaf MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.jclouds.cli:jclouds-cli-assembly =1.6.1-incubating, =1.6.1-incubating, =1.5.0-beta.6,...

de.deepamehta.assemblies.server:deepamehta-distribution (>=4.4.1, <=4.4.3), org.apache.karaf.cellar:org.apache.karaf.cellar.itests (>=2.2.5, <=2.2.6) +3 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.2.9)

org.apache.karaf:apache-karaf MAVEN version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - de.deepamehta.assemblies.server:deepamehta-distribution =4.4.1, =2.2.5, =2.2.6 -...

org.apache.karaf.demos:web (2.2.0), org.apache.karaf.tooling:org.apache.karaf.tooling.testing (2.2.0) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.2.0)

org.apache.karaf:apache-karaf MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web 2.2.0 - org.apache.karaf.tooling:org.apache.karaf.tooling.testing 2.2.0 -...

org.apache.jclouds.cli:jclouds-cli-assembly (>=1.9.0, <=1.9.3), org.apache.karaf.cellar:org.apache.karaf.cellar.itests (>=2.3.3, <=2.3.6) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.3.9)

org.apache.karaf:apache-karaf MAVEN version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.jclouds.cli:jclouds-cli-assembly =1.9.0, =2.3.3, =5.0.6, =5.2.0 Source cves: CVE-2018-1178...

io.fabric8.jube.images.fabric8:karaf (>=2.0.0, <=2.0.5), io.fabric8.jube.images.fabric8:karaf-2.4 (>=2.0.6, <=2.1.5) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.4.0)

org.apache.karaf:apache-karaf MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - io.fabric8.jube.images.fabric8:karaf =2.0.0, =2.0.6, =2.1.5 - org.apache.karaf.demos:web 2.4.0 -...

com.savoirtech.aetos:aetos (>=3.0.2, <=3.0.2.3), org.apache.karaf.cellar:org.apache.karaf.cellar.itests (>=3.0.0, <=3.0.3) +4 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (>=3.0.0.rc1, <=3.0.8)

org.apache.karaf:apache-karaf MAVEN version =3.0.0.rc1, =3.0.2, =3.0.0, =3.0.0.rc1, =6.0.0.m1, =3.0.0.m1, =3.0.0.m2 - org.openengsb.labs.endtoend:labs-endtoend-itests 1.0.0 Source cves: CVE-2018-11787 Source advisory: OSV:GHSA-CQ9C-55R7-455X...

ch.sourcepond.commons:smartswitch-tests (>=2.0.0, <=4.0.2), ch.sourcepond.io:checksum-tests (>=1.0.3, <=4.0.3) +10 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (>=4.0.0, <=4.0.8)

org.apache.karaf:apache-karaf MAVEN version =4.0.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =1.0, =2.18.0, =4.0.0, =4.0.0, =2.6.5, =2.8.7 - org.code-house.validation:itests 4.0.0 Source cves: CVE-2018-11787 Source advisory: OSV:GHSA-CQ9C-55R7-455X...

org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (3.0.0-milestone2) potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.3.3)

org.apache.karaf:apache-karaf MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests 3.0.0-milestone2 Source cves: CVE-2018-11787...

org.apache.karaf.demos:web (2.1.3), org.apache.karaf.tooling:org.apache.karaf.tooling.testing (2.1.3) +2 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (2.1.3)

org.apache.karaf:apache-karaf MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web 2.1.3 - org.apache.karaf.tooling:org.apache.karaf.tooling.testing 2.1.3 -...

ch.sourcepond.commons:smartswitch-tests (>=2.0.0, <=4.0.2), ch.sourcepond.io:checksum-tests (>=1.0.3, <=4.0.3) +10 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (>=4.0.0, <=4.0.8)

org.apache.karaf:apache-karaf MAVEN version =4.0.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =1.0, =2.18.0, =4.0.0, =4.0.0, =2.6.5, =2.8.7 - org.code-house.validation:itests 4.0.0 Source cves: CVE-2018-11787 Source advisory: GHSA-CQ9C-55R7-455X...

CVE-2018-11787

CVE-2018-11787 affects Apache Karaf prior to 3.0.9, 4.0.9 and 4.1.1 where the webconsole opens a Gogo shell and, if Pax Web Extender Whiteboard is present, an unauthenticated /gogo URL can expose the Karaf console. Direct access to /system/console/gogo also requires authentication, but the /gogo ...