CVE-2018-11788: XEE
First published: Mon Jan 07 2019(Updated: )
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.karaf.specs:org.apache.karaf.specs.java.xml | <4.1.7 | 4.1.7 |
| maven/org.apache.karaf.specs:org.apache.karaf.specs.java.xml | >=4.2.0<4.2.2 | 4.2.2 |
| Apache Karaf | <4.1.7 | |
| Apache Karaf | >=4.2.0<=4.2.1 | |
| Apache Karaf | =4.2.0-milestone1 | |
| Apache Karaf | =4.2.0-milestone2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2018-11788
- http://karaf.apache.org/security/cve-2018-11788.txt
- https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
- https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479/
- https://github.com/advisories/GHSA-92wj-x78c-m4fx (Advisory)
- http://www.securityfocus.com/bid/106479
Frequently Asked Questions
What is CVE-2018-11788?
CVE-2018-11788 is a vulnerability found in Apache Karaf, which allows XXE attacks through the features deployer.
What is the severity of CVE-2018-11788?
CVE-2018-11788 has a severity score of 9.8, which is considered critical.
How does CVE-2018-11788 affect Apache Karaf?
CVE-2018-11788 affects Apache Karaf versions up to 4.1.7 and 4.2.2, allowing XXE attacks through the features deployer.
What is an XXE attack?
An XXE attack is an XML External Entity attack, where an attacker can exploit an XML parsing vulnerability to disclose sensitive information or execute arbitrary code.
How can I fix CVE-2018-11788?
To fix CVE-2018-11788, upgrade to Apache Karaf version 4.1.7 or 4.2.2, which contain mitigation codes against XXE attacks.
- collector/github-advisory-latest
- alias/GHSA-92wj-x78c-m4fx
- alias/CVE-2018-11788
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- agent/references
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/maven
- vendor/apache
- canonical/apache karaf
- version/apache karaf/4.2.0
- version/apache karaf/4.2.1
- version/apache karaf/4.2.0-milestone1
- version/apache karaf/4.2.0-milestone2