PT-2019-11183

Name of the Vulnerable Software and Affected Versions: Apache Karaf versions prior to 4.2.3 Description: The issue arises from the Apache Karaf kar deployer's failure to validate paths in .kar archives, allowing a malicious user to craft a .kar file with ".." directory names and write arbitrary...

CVE-2019-0191: Improper Limitation of a Pathname to a Restricted Directory

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

GHSA-92WJ-X78C-M4FX XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

Design/Logic Flaw

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf contains an XXE vulnerability in its XMLInputFactory used by the features deployer. The XMLInputFactory does not implement mitigation against external entities, enabling potential XML External Entity Injection in Karaf versions prior to 4.1.7 and prior to 4.2.2. First fixed in Karaf ...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

org.apache.felix:org.apache.felix.http.bundle (2.2.1), org.apache.felix:org.apache.felix.http.jetty (2.2.1) +54 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.12.v20130726)

org.eclipse.jetty:jetty-server MAVEN version 7.6.12.v20130726 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.1 -...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.3), org.cometd.java:cometd-java-examples (>=2.4.3, <=2.5.0-beta2) +51 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.6.4.v20120524)

org.eclipse.jetty:jetty-server MAVEN version 7.6.4.v20120524 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.3 -...

org.apache.felix:org.apache.felix.http.bundle (2.2.1), org.apache.felix:org.apache.felix.http.jetty (2.2.1) +54 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.6.12.v20130726)

org.eclipse.jetty:jetty-server MAVEN version 7.6.12.v20130726 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.1 -...

athena (>=0.5.0, <=0.8.0), cloudmesh-client (>=4.2.6, <=4.4.0) +14 more potentially affected by CVE-2018-1000805 via paramiko (>=1.15.0, <=2.0.2)

paramiko PYPI version =1.15.0, =0.5.0, =4.2.6, =0.5.1a10, =0.0.4, =1.11.1.post1, =0.1.0, =0.1.0, =1.0.2, =0.51.0, =0.1.0.dev22, =0.1.0.dev27 - streamlocal 0.0.0 - vr-server 6.11.0 and more Source cves: CVE-2018-1000805 Source advisory: GHSA-F2J6-WRHH-V25M...

athena (>=0.5.0, <=0.8.0), cloudmesh-client (>=4.2.6, <=4.4.0) +14 more potentially affected by CVE-2018-1000805 via paramiko (>=1.15.0, <=2.0.2)

paramiko PYPI version =1.15.0, =0.5.0, =4.2.6, =0.5.1a10, =0.0.4, =1.11.1.post1, =0.1.0, =0.1.0, =1.0.2, =0.51.0, =0.1.0.dev22, =0.1.0.dev27 - streamlocal 0.0.0 - vr-server 6.11.0 and more Source cves: CVE-2018-1000805 Source advisory: OSV:PYSEC-2018-69...

athena (>=0.5.0, <=0.8.0), django-fab-deployer (>=0.0.4, <=0.0.11) +4 more potentially affected by CVE-2018-7750 via paramiko (>=1.15.0, <=1.15.4)

paramiko PYPI version =1.15.0, =0.5.0, =0.0.4, =0.1.0, =0.1.0, =0.51.0, =0.52.0 - streamlocal 0.0.0 Source cves: CVE-2018-7750 Source advisory: GHSA-232R-66CG-79PX...

Security Bulletin: A security vulnerability has been identified in IBM Workload Deployer shipped with SmartCloud Orchestrator (CVE-2014-6158)

Summary IBM Workload Deployer is shipped as a component of IBM SmartCloud Orchestrator. Information about a security vulnerability affecting IBM Workload Deployer has been published in a security bulletin. Vulnerability Details Review security bulletin Security Bulletin: File path traversal...

Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer shipped with IBM SmartCloud Orchestrator (CVE-2014-6158)

Summary File path traversal vulnerabilities affect IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator CVE-2014-6158. Vulnerability Details Consult the Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer CVE-2014-6158 document for vulnerability...

Security Bulletin: Log Viewer vulnerability affects IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator (CVE-2014-6190)

Summary Log Viewer vulnerability affects IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator CVE-2014-6190. Vulnerability Details For vulnerability details, see the IBM Workload Deployer Security Bulletin. Affected Products and Versions IBM SmartCloud Orchestrator 2.2 and 2.2...

Security Bulletin: Vulnerabilities in Open Source GNU glibc affect IBM Workload Deployer (CVE-2014-9761, CVE-2015-8778, CVE-2015-8779)

Summary Vulnerabilities in Open Source GNU glibc affect IWD Workload Deployer. Vulnerability Details CVEID: CVE-2014-9761 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the nan function. By sending an overly long string, a...