PT-2022-11480 · Apache · Apache Karaf

Daniel Heyne + 2 · Published 2022-01-26 · Updated 2022-02-03 · CVE-2021-41766

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Karaf (affected versions not specified)

Description The issue concerns Apache Karaf's use of Java Management Extensions (JMX) for monitoring applications and the Java runtime. JMX relies on Java serialized objects for client-server communication, and the implementation used by Apache Karaf is not protected against unauthenticated deserialization attacks. The impact of Java deserialization vulnerabilities depends on the classes available within the target's class path. Deserialization of untrusted data represents a high security risk and should be prevented. By default, Karaf uses a limited set of classes in the JMX server class path, which reduces the risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-41766

GHSA-JH5G-9M4V-9VV9

Affected Products

Apache Karaf

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-41766 · Security Note
• https://osv.dev/vulnerability/GHSA-jh5g-9m4v-9vv9 · Vendor Advisory
• https://karaf.apache.org/security/cve-2021-41766.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41766 · Vendor Advisory
• https://github.com/apache/karaf · Note
• https://github.com/apache/karaf/pull/1475 · Note
• https://github.com/apache/karaf/commit/b42c82ca3b9a22bd92d249a1060a1953f4188bc2 · Note
• https://gitbox.apache.org/repos/asf?p=karaf.git;h=93a019c · Note
• https://gitbox.apache.org/repos/asf?p=karaf.git;h=b42c82c · Note
• https://t.me/cibsecurity/36294 · Telegram Post
• https://issues.apache.org/jira/browse/KARAF-7312 · Note