Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkyd2oteDc4Yy1tNGZ4

XML External Entity Reference in Apache Karaf

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

Permalink: https://github.com/advisories/GHSA-92wj-x78c-m4fx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkyd2oteDc4Yy1tNGZ4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: 8 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-92wj-x78c-m4fx, CVE-2018-11788
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-11788
• http://karaf.apache.org/security/cve-2018-11788.txt
• https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
• https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479/
• https://github.com/advisories/GHSA-92wj-x78c-m4fx

Repository: https://github.com/apache/karaf
Blast Radius: 10.9

Affected Packages