karaf-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jean-Baptiste Onofré ...@nanthrax.net>
Subject [SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf
Date Thu, 07 Mar 2019 12:53:59 GMT
A new security advisory has been released for Apache Karaf, that is
fixed in recent 4.2.3 release.

CVE-2019-0191: Zip-slip vulnerability in KAR deployer

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected: all versions of Apache Karaf prior to 4.2.3

Description:

Apache Karaf kar deployer reads .kar archives and extracts the paths from
the "repository/" and "resources/" entries in the zip file.

It then writes out the content of these paths to the Karaf repo and
resources
directories. However, it doesn't do any validation on the paths in the zip
file. This means that a malicious user could craft a .kar file with ".."
directory names and break out of the directories to write arbitrary content
to the filesystem. This is the "Zip-slip" vulnerability -
https://snyk.io/research/zip-slip-vulnerability

This vulnerability is low if the Karaf process user has limited permission
on the filesystem.

The mitigation is to prevent "Zip-slip" by checking the path used in kar
zip
entries and prevent use of ".." path.

This has been fixed in revision:

https://gitbox.apache.org/repos/asf?p=karaf.git;h=fef9a61
https://gitbox.apache.org/repos/asf?p=karaf.git;h=e36a7a6

Mitigation: Apache Karaf users should upgrade to 4.2.3
or later as soon as possible, or limit filesystem permission for the Karaf
process user.

JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-6090

Credit: This issue was reported by Colm O hEigeartaigh



Mime
View raw message