PT-2022-15741 · Apache · Apache Karaf

Jaroslav Lobacevski · Published 2022-01-26 · Updated 2022-02-03 · CVE-2022-22932

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.2.15 Apache Karaf versions prior to 4.3.6

Description The issue is related to partial path traversal in Apache Karaf obr:* commands and the run goal on the karaf-maven-plugin, allowing an attacker to break out of the expected folder. The risk is considered low because obr:* commands are not commonly used and the entry point is set by the user.

Recommendations For versions prior to 4.2.15, upgrade to 4.2.15 or later as soon as possible, or use the correct path. For versions prior to 4.3.6, upgrade to 4.3.6 or later as soon as possible, or use the correct path.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-22932

GHSA-544X-2JX9-4PFG

Affected Products

Apache Karaf

References · 10

• https://karaf.apache.org/security/cve-2022-22932.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22932 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22932 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-544x-2jx9-4pfg · Vendor Advisory
• https://github.com/apache/karaf · Note
• https://github.com/apache/karaf/pull/1485 · Note
• https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 · Note
• https://issues.apache.org/jira/browse/KARAF-7326 · Note
• https://t.me/cibsecurity/36292 · Telegram Post
• https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf · Note