CVE-2018-11788

概述 Apache Karaf 是一个现代且多态的应用容器。它是一个由 OSGi 提供支持的轻量级、功能强大且企业就绪的容器。Apache Karaf 是一个"产品项目"，提供完整且开箱即用的运行时。该运行时是"多面"的，这意味着你可以部署不同类型的应用：OSGi 或非 OSGi、Web 应用、基于服务的应用等。 在最近对 Apache Karaf 的研究中，我发现在其 XML 解析器上存在一些 XXE（XML 外部实体注入）漏洞。该问题是由于解析器未正确解析 XML 文档所致。 受影响版本 Apache Karaf ... ... ... 为了了解部署器如何处理 XML 文件，我查看了...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

CVE-2018-11788

Apache Karaf contains an XXE vulnerability in its XMLInputFactory used by the features deployer. The XMLInputFactory does not implement mitigation against external entities, enabling potential XML External Entity Injection in Karaf versions prior to 4.1.7 and prior to 4.2.2. First fixed in Karaf ...