Apache Karaf Arbitrary File Overwrite Vulnerability

Apache Karaf is the United States Apache Apache Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. An arbitrary file overwrite vulnerability exists in Apache Karaf versions prior to 4.2.3, which can be exploited by a remote...

ch.sourcepond.commons:smartswitch-tests (>=2.0.0 <=4.0.2), ch.sourcepond.io:checksum-tests (>=1.0.3 <=4.0.3) +46 more potentially affected by CVE-2019-0191 via org.apache.karaf:apache-karaf (>=2.0.0 <=4.2.16)

org.apache.karaf:apache-karaf MAVEN version =2.0.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =1.5, =1.5.6, =4.4.1, =1.1.2, =1.0.0, =2.0.0, =2.0.6, =4.2.10.hyte-42101, =4.1.6.hyte-4008, =4.2.11.hyte-42119 and more Source cves: CVE-2019-0191 Source advisory: OSV:GHSA-869J-5855-HJPM...

Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

GHSA-869J-5855-HJPM Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

CVE-2019-0191

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

CVE-2019-0191

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

Security feature bypass

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

CVE-2019-0191

Summary: CVE-2019-0191 affects Apache Karaf kar deployer. The ZIP-slip vulnerability arises because the kar deployer reads .kar archives and extracts entries from repository/ and resources/ without validating paths, allowing a malicious .kar to contain directory traversal (..), which can cause th...

CVE-2019-0191

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

Zip Slip Vulnerability

Apache Karaf is vulnerable to zip slip. The vulnerability exists because it does not validate the presence of .. in the file path before performing the extraction of files from the "repository/" and "resources/" entries in the zip file and directly writing the content to its repository and...

Apache Karaf XML External Entity Injection Vulnerability

Apache Karaf is the United States Apache Apache Software Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. An XML external entity injection vulnerability exists in Apache Karaf versions prior to 4.1.7 and prior to 4.2.2. An...

com.cibuddy:karaf.assembly (=1.0.0), com.kagurabi.services:kagura-assembly (>=1.5 <=1.9) +23 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (>=2.0.0 <=3.0.8)

org.apache.karaf:apache-karaf MAVEN version =2.0.0, =1.5, =1.5.6, =4.4.1, =1.1.2, =2.0.0, =2.0.6, =2.7.7, =3.0.0, =1.6.1-incubating, =1.6.1-incubating, =2.2.3, =2.0.0, =2.0.0, =2.2.11 and more Source cves: CVE-2018-11787 Source advisory: OSV:GHSA-CQ9C-55R7-455X...

ch.sourcepond.commons:smartswitch-tests (>=2.0.0 <=4.0.2), ch.sourcepond.io:checksum-tests (>=1.0.3 <=4.0.3) +10 more potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (>=4.0.0 <=4.0.8)

org.apache.karaf:apache-karaf MAVEN version =4.0.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =1.0, =2.18.0, =4.0.0, =4.0.0, =2.8.7, =2.6.5, =2.8.11 - org.code-house.validation:itests =4.0.0 Source cves: CVE-2018-11787 Source advisory: OSV:GHSA-CQ9C-55R7-455X...

org.apache.karaf.demos:web (=4.1.0) potentially affected by CVE-2018-11787 via org.apache.karaf:apache-karaf (=4.1.0)

org.apache.karaf:apache-karaf MAVEN version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.karaf:apache-karaf and may be impacted: - org.apache.karaf.demos:web =4.1.0 Source cves: CVE-2018-11787 Source advisory: OSV:GHSA-CQ9C-55R7-45...

Improper Authentication in Apache Karaf

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web...

GHSA-CQ9C-55R7-455X Improper Authentication in Apache Karaf

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web...

com.influxdb:influxdb-karaf (>=2.2.0 <=5.0.0), com.influxdb:influxdb-karaf-assembly (>=2.2.0 <=5.0.0) +51 more potentially affected by CVE-2018-11788 via org.apache.karaf.specs:org.apache.karaf.specs.java.xml (>=4.2.0 <=4.2.16)

org.apache.karaf.specs:org.apache.karaf.specs.java.xml MAVEN version =4.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =4.2.0.1, =1.2.0, =1.2.0, =2.0.2, =4.2.10.hyte-42101, =4.2.10.hyte-42101, =4.2.10.hyte-42101, =1.4.25.Final, =0.0.1, =4.0, =11.4.2 and more Source cves: CVE-2018-11788 Source advisory:...

GHSA-92WJ-X78C-M4FX XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

com.cibuddy:karaf.assembly (=1.0.0), com.kagurabi.services:kagura-assembly (>=1.5 <=1.9) +28 more potentially affected by CVE-2016-8750 via org.apache.karaf:apache-karaf (>=2.0.0 <=4.0.7)

org.apache.karaf:apache-karaf MAVEN version =2.0.0, =1.5, =1.5.6, =4.4.1, =1.1.2, =1.0.0, =2.0.0, =2.0.6, =1.0, =2.18.0, =2.7.7, =3.0.0, =1.6.1-incubating, =1.6.1-incubating, =2.0.3 and more Source cves: CVE-2016-8750 Source advisory: OSV:GHSA-CHJ8-5XGW-WCVJ...