GHSA-544x-2jx9-4pfg

    Dashboard / Vulnerabilities / GHSA-544x-2jx9-4pfg

    GHSA-544x-2jx9-4pfg

    Published: 28 Jan 2022Last Modified: 8 Nov 2023

    Summary: Path traversal in Apache Karaf

    Details: Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-22932, https://github.com/apache/karaf/pull/1485, https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4, https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf, https://github.com/apache/karaf, https://issues.apache.org/jira/browse/KARAF-7326, https://karaf.apache.org/security/cve-2022-22932.txt

    Affected packages

    Package

    Name: org.apache.karaf:apache-karaf

    Purl: pkg:maven/org.apache.karaf/apache-karaf

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.3.0
    Fixed -4.3.6

    Affected versions

    4.3.0
    4.3.1
    4.3.2
    4.3.3
    4.3.4
    4.3.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-544x-2jx9-4pfg | CVE-DB