[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 7 Mar 2019 13:53:59 +0100
From: Jean-Baptiste Onofré <jb@...thrax.net>
To: user@...af.apache.org, Karaf Dev <dev@...af.apache.org>,
Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com,
Colm O hEigeartaigh <coheigea@...che.org>
Subject: [SECURITY] New security advisory for CVE-2019-0191 released for
Apache Karaf
A new security advisory has been released for Apache Karaf, that is
fixed in recent 4.2.3 release.
CVE-2019-0191: Zip-slip vulnerability in KAR deployer
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected: all versions of Apache Karaf prior to 4.2.3
Description:
Apache Karaf kar deployer reads .kar archives and extracts the paths from
the "repository/" and "resources/" entries in the zip file.
It then writes out the content of these paths to the Karaf repo and
resources
directories. However, it doesn't do any validation on the paths in the zip
file. This means that a malicious user could craft a .kar file with ".."
directory names and break out of the directories to write arbitrary content
to the filesystem. This is the "Zip-slip" vulnerability -
https://snyk.io/research/zip-slip-vulnerability
This vulnerability is low if the Karaf process user has limited permission
on the filesystem.
The mitigation is to prevent "Zip-slip" by checking the path used in kar
zip
entries and prevent use of ".." path.
This has been fixed in revision:
https://gitbox.apache.org/repos/asf?p=karaf.git;h=fef9a61
https://gitbox.apache.org/repos/asf?p=karaf.git;h=e36a7a6
Mitigation: Apache Karaf users should upgrade to 4.2.3
or later as soon as possible, or limit filesystem permission for the Karaf
process user.
JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-6090
Credit: This issue was reported by Colm O hEigeartaigh
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
