VulnerableCode Package Details - pkg:maven/org.apache.karaf/karaf@2.3.5

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.apache.karaf/karaf@2.3.5

Essentials
History (4)

purl	pkg:maven/org.apache.karaf/karaf@2.3.5

Next non-vulnerable version	4.2.5
Latest non-vulnerable version	4.3.6
Risk	4.0

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-gkcn-5pj5-2ugn Aliases: CVE-2019-0226 GHSA-fjw4-39pg-vf4f	Path Traversal Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem.	4.2.5 Affected by 0 other vulnerabilities.
VCID-gq9d-gg4k-ebhd Aliases: CVE-2018-11786 GHSA-9448-c9wq-jg9v		4.2.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-hf1y-5953-bkhc Aliases: CVE-2018-11787 GHSA-cq9c-55r7-455x		3.0.9 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.1.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-vs7q-k273-4bcb Aliases: CVE-2019-0191 GHSA-869j-5855-hjpm	Path Traversal Apache Karaf kar deployer reads `.kar` archives and extracts the paths from the `repository/` and `resources/` entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it does not do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with `..` directory names and break out of the directories to write arbitrary content to the filesystem.	4.2.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-05-31T09:56:15.303857+00:00	GitLab Importer	Affected by	VCID-gkcn-5pj5-2ugn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/karaf/CVE-2019-0226.yml	38.6.0
2026-05-31T09:54:54.345001+00:00	GitLab Importer	Affected by	VCID-vs7q-k273-4bcb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/karaf/CVE-2019-0191.yml	38.6.0
2026-05-31T09:49:32.449918+00:00	GitLab Importer	Affected by	VCID-hf1y-5953-bkhc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/karaf/CVE-2018-11787.yml	38.6.0
2026-05-31T09:49:32.098560+00:00	GitLab Importer	Affected by	VCID-gq9d-gg4k-ebhd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/karaf/CVE-2018-11786.yml	38.6.0