Moderate severityNVD Advisory· Published May 9, 2019· Updated Aug 4, 2024
CVE-2019-0226
CVE-2019-0226
Description
Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.karaf.config:org.apache.karaf.config.coreMaven | < 4.2.5 | 4.2.5 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-fjw4-39pg-vf4fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-0226ghsaADVISORY
- github.com/apache/karaf/pull/805ghsaWEB
- issues.apache.org/jira/browse/KARAF-6230ghsaWEB
- lists.apache.org/thread.html/1baa6f1df0e95fb1cd679067117354af2ab4423277d9a0ff6e8bf790%40%3Cdev.karaf.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/1baa6f1df0e95fb1cd679067117354af2ab4423277d9a0ff6e8bf790@%3Cdev.karaf.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r218c7e017af0a860ae21bf7ab77520fd2070c8f52db680eeec03a266%40%3Ccommits.karaf.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/r218c7e017af0a860ae21bf7ab77520fd2070c8f52db680eeec03a266@%3Ccommits.karaf.apache.org%3EghsaWEB
News mentions
0No linked articles in our index yet.