You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@karaf.apache.org by "janpaul1988 (via GitHub)" <gi...@apache.org> on 2026/06/17 10:00:40 UTC
[I] Critical CVE in equinox 3.18.0 [karaf]
janpaul1988 opened a new issue, #2731:
URL: https://github.com/apache/karaf/issues/2731
Our repository dependency blocker has flagged and quarantained the following artifact:
https://mvnrepository.com/artifact/org.apache.karaf.assemblies.features/features/4.4.11
The underlying cause is most likely the following critical issue (9.8)
https://guide.sonatype.com/vulnerability/CVE-2023-54342
in equinox 3.18.0.
Could it be possible to upgrade this version to 3.18.600? I believe it is fully compatible, it would be great if it could be fixed backwards also in at least version 4.4.11.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@karaf.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Critical CVE in equinox 3.18.0 in karaf.assemblies.features [karaf]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre closed issue #2731: Critical CVE in equinox 3.18.0 in karaf.assemblies.features
URL: https://github.com/apache/karaf/issues/2731
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@karaf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Critical CVE in equinox 3.18.0 in karaf.assemblies.features [karaf]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #2731:
URL: https://github.com/apache/karaf/issues/2731#issuecomment-5651425267
See my comment in the PR: it's fine to update to Equiinox 3.18.600, but I would like to clarify the CVE reason.
The CVE describes RCE via a fork console command reachable over an unauthorized telnet connection to Equinox's console interface.
Karaf doesn't use osgi.console from Equinox as we use our own SSH server/shell, not Equinox's built-in console, so we are not vulnerable.
So, upgrading to make the scanner happy (people just see that without checking if it's actually vulnerable 😄 ),but we are not fixing the CVE as we are not impacted.
So please, before assuming any security issue, verify it's actually the case 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@karaf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org