CVE-2019-0191
Description
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
How to fix
- apache karaf4.2.3 or later
- org.apache.karaf:karaf4.2.3 or later
- org.apache.karaf:apache-karaf4.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache karaf | v < 4.2.3 | 4.2.3 |
| org.apache.karaf:karafMaven | v < 4.2.3 | 4.2.3 |
| org.apache.karaf:apache-karafMaven | v < 4.2.3 | 4.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.