github - ghsa-jh5g-9m4v-9vv9

ghsa-jh5g-9m4v-9vv9

Vulnerability from github

Published

2022-01-28 22:24

Modified

2023-09-11 22:18

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Insecure Java Deserialization in Apache Karaf

Details

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.karaf.management:org.apache.karaf.management.server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-27T23:08:06Z",
    "nvd_published_at": "2022-01-26T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).",
  "id": "GHSA-jh5g-9m4v-9vv9",
  "modified": "2023-09-11T22:18:57Z",
  "published": "2022-01-28T22:24:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/karaf/pull/1475"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/karaf/commit/b42c82ca3b9a22bd92d249a1060a1953f4188bc2"
    },
    {
      "type": "WEB",
      "url": "https://gitbox.apache.org/repos/asf?p=karaf.git;h=93a019c"
    },
    {
      "type": "WEB",
      "url": "https://gitbox.apache.org/repos/asf?p=karaf.git;h=b42c82c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/karaf"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/KARAF-7312"
    },
    {
      "type": "WEB",
      "url": "https://karaf.apache.org/security/cve-2021-41766.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Insecure Java Deserialization in Apache Karaf"
}

cve-2021-41766

Vulnerability from cvelistv5

Published

2022-01-26 11:10

Modified

2024-08-04 03:15

Severity ?

Summary

References

▼	URL	Tags
	https://karaf.apache.org/security/cve-2021-41766.txt	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache Karaf

Version: Apache Karaf < 4.3.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:15:29.312Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://karaf.apache.org/security/cve-2021-41766.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Karaf",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.3.6",
              "status": "affected",
              "version": "Apache Karaf",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was reported by Daniel Heyne, Konstantin Samuel and Tobias Neitzel."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder)."
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Insecure Java Deserialization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-26T11:10:11",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://karaf.apache.org/security/cve-2021-41766.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insecure Java Deserialization in Apache Karaf",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apache Karaf users should upgrade to 4.3.6 or later as soon as possible, or disable remote access to JMX server."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-41766",
          "STATE": "PUBLIC",
          "TITLE": "Insecure Java Deserialization in Apache Karaf"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Karaf",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache Karaf",
                            "version_value": "4.3.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was reported by Daniel Heyne, Konstantin Samuel and Tobias Neitzel."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder)."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder)."
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Insecure Java Deserialization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://karaf.apache.org/security/cve-2021-41766.txt",
              "refsource": "MISC",
              "url": "https://karaf.apache.org/security/cve-2021-41766.txt"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Apache Karaf users should upgrade to 4.3.6 or later as soon as possible, or disable remote access to JMX server."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-41766",
    "datePublished": "2022-01-26T11:10:11",
    "dateReserved": "2021-09-27T00:00:00",
    "dateUpdated": "2024-08-04T03:15:29.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted