org.apache.karaf/karaf vulnerabilities

Latest org.apache.karaf/karaf CVEs

Newest publication first

1. CVE-2019-0191 Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf

   Published 2019-03-20

   Medium·CVSS 6.5 EPSS 4.9%

   Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.