<!--X-Body-Begin-->
<!--X-User-Header-->
oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->
By Date
By Thread
</form>
<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
[SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->
From: Jean-Baptiste Onofré <jb () nanthrax net>
Date: Thu, 7 Mar 2019 13:53:59 +0100
<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
A new security advisory has been released for Apache Karaf, that is
fixed in recent 4.2.3 release.
CVE-2019-0191: Zip-slip vulnerability in KAR deployer
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected: all versions of Apache Karaf prior to 4.2.3
Description:
Apache Karaf kar deployer reads .kar archives and extracts the paths from
the "repository/" and "resources/" entries in the zip file.
It then writes out the content of these paths to the Karaf repo and
resources
directories. However, it doesn't do any validation on the paths in the zip
file. This means that a malicious user could craft a .kar file with ".."
directory names and break out of the directories to write arbitrary content
to the filesystem. This is the "Zip-slip" vulnerability -
https://snyk.io/research/zip-slip-vulnerability
This vulnerability is low if the Karaf process user has limited permission
on the filesystem.
The mitigation is to prevent "Zip-slip" by checking the path used in kar
zip
entries and prevent use of ".." path.
This has been fixed in revision:
https://gitbox.apache.org/repos/asf?p=karaf.git;h=fef9a61
https://gitbox.apache.org/repos/asf?p=karaf.git;h=e36a7a6
Mitigation: Apache Karaf users should upgrade to 4.2.3
or later as soon as possible, or limit filesystem permission for the Karaf
process user.
JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-6090
Credit: This issue was reported by Colm O hEigeartaigh
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
By Date
By Thread
Current thread:
[SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf Jean-Baptiste Onofré (Mar 07)
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->