[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1c9e7212-f8a7-04b2-a956-17f7bce8c3bb@nanthrax.net>
Date: Sun, 6 Jan 2019 07:23:52 +0100
From: Jean-Baptiste Onofré <jb@...thrax.net>
To: user@...af.apache.org, Karaf Dev <dev@...af.apache.org>,
Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com,
Brian Wang <brianwangrewa@...il.com>
Subject: [SECURITY] New security advisory for CVE-2018-11788 released for
Apache Karaf
A new security advisory has been released for Apache Karaf, that is
fixed in recent 4.1.7 and 4.2.2 releases.
CVS-2018-11788: XXE vulnerability found on Apache Karaf
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected: all versions of Apache Karaf prior to 4.1.7, 4.2.2.
Description:
Apache Karaf provides a features deployer, which allows users to "hot
deploy"
a features XML by dropping the file directly in the deploy folder.
The features XML is parsed by XMLInputFactory class.
Apache Karaf XMLInputFactory class doesn't contain any mitigation codes
against XXE.
This is a potential security risk as an user can inject external XML
entities.
The mitigation is to prevent XXE by disabling external entities loading
feature
in XMLInputFactory and XmlUtils.
This has been fixed in revision:
https://gitbox.apache.org/repos/asf?p=karaf.git;h=cc3332e
https://gitbox.apache.org/repos/asf?p=karaf.git;h=1ffa6d1
Mitigation: Apache Karaf users should upgrade to 4.1.7, 4.2.2
or later as soon as possible.
JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-5911
Credit: This issue was reported by Brian Wang.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
