Search for packages
| purl | pkg:maven/org.apache.karaf/apache-karaf@2.3.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-999e-zmqs-u7fw
Aliases: CVE-2014-0219 GHSA-m6g3-xq5q-4hg9 |
Improper Input Validation Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports. |
Affected by 3 other vulnerabilities. |
|
VCID-9r9v-r4ee-h7c7
Aliases: CVE-2022-40145 GHSA-c2p4-8mvv-rwmv |
karaf: JDBC JAAS LDAP injection |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-bn32-dwf4-x7ch
Aliases: CVE-2018-11787 GHSA-cq9c-55r7-455x |
Improper Authentication When Pax Web Extender Whiteboard is installed, the Karaf console becomes available at another (insecure) URL giving access to the Karaf console to unauthenticated users. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-czhh-a73d-13hp
Aliases: CVE-2016-8750 GHSA-chj8-5xgw-wcvj |
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service. |
Affected by 5 other vulnerabilities. |
|
VCID-srxe-9dxr-qkc4
Aliases: CVE-2018-11786 GHSA-9448-c9wq-jg9v |
Improper Privilege Management In Apache Karaf, if the sshd service in Karaf is left on, an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. |
Affected by 2 other vulnerabilities. |
|
VCID-teun-jmsg-67hz
Aliases: CVE-2019-0191 GHSA-869j-5855-hjpm |
Path Traversal Apache Karaf kar deployer reads `.kar` archives and extracts the paths from the `repository/` and `resources/` entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it does not do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with `..` directory names and break out of the directories to write arbitrary content to the filesystem. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||