Critical severityNVD Advisory· Published Jan 7, 2019· Updated Aug 5, 2024
CVE-2018-11788
CVE-2018-11788
Description
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.karaf.specs:org.apache.karaf.specs.java.xmlMaven | >= 4.2.0, < 4.2.2 | 4.2.2 |
org.apache.karaf.specs:org.apache.karaf.specs.java.xmlMaven | < 4.1.7 | 4.1.7 |
Affected products
2- Apache Software Foundation/Apache Karafv5Range: Any Apache Karaf version prior to 4.1.7 and 4.2.2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-92wj-x78c-m4fxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-11788ghsaADVISORY
- karaf.apache.org/security/cve-2018-11788.txtghsax_refsource_MISCWEB
- www.securityfocus.com/bid/106479mitrevdb-entryx_refsource_BID
- github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafcaghsaWEB
- web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479ghsaWEB
News mentions
0No linked articles in our index yet.