You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@karaf.apache.org by "Jean-Baptiste Onofré (Jira)" <ji...@apache.org> on 2021/07/19 05:49:00 UTC

[jira] [Assigned] (KARAF-7224) Impact of CVE-2021-26291 on Karaf

     [ https://issues.apache.org/jira/browse/KARAF-7224?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jean-Baptiste Onofré reassigned KARAF-7224:
-------------------------------------------

    Assignee: Jean-Baptiste Onofré

> Impact of CVE-2021-26291 on Karaf
> ---------------------------------
>
>                 Key: KARAF-7224
>                 URL: https://issues.apache.org/jira/browse/KARAF-7224
>             Project: Karaf
>          Issue Type: Question
>          Components: karaf
>    Affects Versions: 4.3.2
>            Reporter: Karthick
>            Assignee: Jean-Baptiste Onofré
>            Priority: Major
>
> The CVE-2021-26291 reports about maven version lesser than 3.8.1 is vulnerable to XRI attacks where malicious attacker can imitate a repository. Apache Karaf 4.3.2 includes pax-url-aether which packs Maven artifacts of version 3.6.x. So the CVE impacts Karaf 4.3.2. But does the issue specified in the CVE like maven pulling dependencies from remote directories really affect Karaf during runtime? Is it possible that a PoC has been done to validate this impact on Karaf?



--
This message was sent by Atlassian Jira
(v8.3.4#803005)