search

akash-k-ephesoft / test-1

Other
0 stars 0 forks source link

org.apache.karaf.util-3.0.3.jar: 1 vulnerabilities (highest severity is: 9.8) #35

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago
Vulnerable Library - org.apache.karaf.util-3.0.3.jar

Karaf Util contains utility classes used in different Karaf modules.

Path to vulnerable library: /lib/org.apache.karaf.util-3.0.3.jar

Found in HEAD commit: bafe36287e51aaacdb1ab47c78bd429757cdc4f2

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (org.apache.karaf.util version) Remediation Possible**
CVE-2018-11788 Critical 9.8 org.apache.karaf.util-3.0.3.jar Direct 4.1.7 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-11788 ### Vulnerable Library - org.apache.karaf.util-3.0.3.jar

Karaf Util contains utility classes used in different Karaf modules.

Path to vulnerable library: /lib/org.apache.karaf.util-3.0.3.jar

Dependency Hierarchy: - :x: **org.apache.karaf.util-3.0.3.jar** (Vulnerable Library)

Found in HEAD commit: bafe36287e51aaacdb1ab47c78bd429757cdc4f2

Found in base branch: main

### Vulnerability Details

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

Publish Date: 2019-01-07

URL: CVE-2018-11788

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11788

Release Date: 2019-01-07

Fix Resolution: 4.1.7

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)