Description

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

Remediation

References

http://karaf.apache.org/security/cve-2018-11788.txt

http://www.securityfocus.com/bid/106479

Related Vulnerabilities

CVE-2022-31690 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

CVE-2021-27516 Vulnerability in maven package org.webjars.bower:urijs

CVE-2023-49656 Vulnerability in maven package org.jenkins-ci.plugins:matlab

CVE-2020-28923 Vulnerability in maven package com.typesafe.play:play

CVE-2022-43434 Vulnerability in maven package io.jenkins.plugins:neuvector-vulnerability-scanner

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry