Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 7 Mar 2019 13:53:59 +0100
From: Jean-Baptiste Onofré <>
To:, Karaf Dev <>,
 Apache Security Team <>,,
 Colm O hEigeartaigh <>
Subject: [SECURITY] New security advisory for CVE-2019-0191 released for
 Apache Karaf

A new security advisory has been released for Apache Karaf, that is
fixed in recent 4.2.3 release.

CVE-2019-0191: Zip-slip vulnerability in KAR deployer

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected: all versions of Apache Karaf prior to 4.2.3


Apache Karaf kar deployer reads .kar archives and extracts the paths from
the "repository/" and "resources/" entries in the zip file.

It then writes out the content of these paths to the Karaf repo and
directories. However, it doesn't do any validation on the paths in the zip
file. This means that a malicious user could craft a .kar file with ".."
directory names and break out of the directories to write arbitrary content
to the filesystem. This is the "Zip-slip" vulnerability -

This vulnerability is low if the Karaf process user has limited permission
on the filesystem.

The mitigation is to prevent "Zip-slip" by checking the path used in kar
entries and prevent use of ".." path.

This has been fixed in revision:;h=fef9a61;h=e36a7a6

Mitigation: Apache Karaf users should upgrade to 4.2.3
or later as soon as possible, or limit filesystem permission for the Karaf
process user.

JIRA Tickets:

Credit: This issue was reported by Colm O hEigeartaigh

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.