QID 981121

QID 981121: Java (maven) Security Update for org.apache.karaf:apache-karaf (GHSA-cq9c-55r7-455x)

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Critical - 8.1 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

Customers are advised to refer to GHSA-cq9c-55r7-455x for updates pertaining to this vulnerability.

Vendor References

GHSA-cq9c-55r7-455x - github.com/advisories/GHSA-cq9c-55r7-455x

CVEs related to QID 981121

CVE-2018-11787 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-cq9c-55r7-455x	org.apache.karaf:apache-karaf		github.com/advisories/GHSA-cq9c-55r7-455x

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].