| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA256 |
| |
| CVE-2019-0191: Zip-slip vulnerability in KAR deployer |
| |
| Severity: Low |
| |
| Vendor: The Apache Software Foundation |
| |
| Versions Affected: all versions of Apache Karaf prior to 4.2.3 |
| |
| Description: |
| |
| Apache Karaf kar deployer reads .kar archives and extracts the paths from |
| the "repository/" and "resources/" entries in the zip file. |
| |
| It then writes out the content of these paths to the Karaf repo and resources |
| directories. However, it doesn't do any validation on the paths in the zip |
| file. This means that a malicious user could craft a .kar file with ".." |
| directory names and break out of the directories to write arbitrary content |
| to the filesystem. This is the "Zip-slip" vulnerability - |
| https://snyk.io/research/zip-slip-vulnerability |
| |
| This vulnerability is low if the Karaf process user has limited permission |
| on the filesystem. |
| |
| The mitigation is to prevent "Zip-slip" by checking the path used in kar zip |
| entries and prevent use of ".." path. |
| |
| This has been fixed in revision: |
| |
| https://gitbox.apache.org/repos/asf?p=karaf.git;h=fef9a61 |
| https://gitbox.apache.org/repos/asf?p=karaf.git;h=e36a7a6 |
| |
| Mitigation: Apache Karaf users should upgrade to 4.2.3 |
| or later as soon as possible, or limit filesystem permission for the Karaf |
| process user. |
| |
| JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-6090 |
| |
| Credit: This issue was reported by Colm O hEigeartaigh |
| -----BEGIN PGP SIGNATURE----- |
| |
| iQIzBAEBCAAdFiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAlyBFD0ACgkQv/LuQsgo |
| LnbxYA//VC4yJ8uWEyBx5cozyCjwEgJo9um5P7DGx9VkqGtOBmOrlfVlP7kmVdJV |
| FWOWDAAPw93UYwlqdEsBiM5hxZQW5I9W9QZv5HFY/wzyY+AdCG7vf1VDBq9Vnj/4 |
| tHbIs53yke83+q9xMQFFenOHmMrN/L4L+5y0eXkjtQOdMno3m8EIuwTS32tSEl2v |
| nG7CiCRazDLziMG4gxgb8rSFBx7ZVjuTuHUbqtfTxHAYtHjGoP5+EFFk//iqtVR+ |
| mr4KXAPG+PY0I4iq3FN3PTaS/ljPtcJOUtP1LcqPhll5iWpqOnGULUCHzgQTk8ZN |
| auPxfsyXnBMT+zt4VwHEWWQ66Zf5EQYhP2MBHTS2RHsTgTn0GP8cH7gAhg1jnozH |
| tdZ25B2xPRFqWqqNBgdIOvKvPlQ9aOryZLZkjmK3DkGA0GLpKjUWmZS30edQ5bOP |
| ovFTN0YRDb4YK7UNR4cvqEF2zOjT77DQz2uaOIKwaEae86702Zyg21sww8yEbJ71 |
| LfQMKh6sNCAgBuYMCNcmIbTs4GMjws07UJa9kmgcrYnzzzF2pLCUl9I4uXw5zs/G |
| xsM3hexiKTYjeR4mO8t6TERVaB58h0aJrb3envL9hbiMy8bOGCNW5x8zpqdw/cH8 |
| +1pRzxMkFNw+SIQtb+1hqdbh+KwzZAzks2gnlmS3zfRU506mzQ0= |
| =SVQ5 |
| -----END PGP SIGNATURE----- |
