Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.karaf:apache-karaf

7 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical
Registry
Maven Central

Advisories 7

  • CVE-2022-40145Critical 9.8

    Apache Karaf: JDBC JAAS LDAP injection

    Affected: fixed in 4.3.8; from 4.4.0, fixed in 4.4.2.

  • Path traversal flaws

    Affected: from 4.3.0, fixed in 4.3.6; fixed in 4.2.15.

  • Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file.

    Affected: fixed in 4.2.3.

  • In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at…

    Affected: fixed in 3.0.9; from 4.0.0, fixed in 4.0.9; from 4.1.0, fixed in 4.1.1.

  • In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any…

    Affected: fixed in 4.2.0.

  • Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP.

    Affected: fixed in 4.0.8.

  • Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service…

    Affected: fixed in 4.0.10.