Path traversal in Apache Karaf
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 8 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Karaf | Apache Karaf version prior to 4.2.3 | — | No fix listed | CNA |
| — | org.apache.karaf:karaf (Maven) | before 4.2.3 | 4.2.3 | Patch available | GHSA-869j-5855-hjpm |
| — | org.apache.karaf:apache-karaf (Maven) | before 4.2.3 | 4.2.3 | Patch available | GHSA-869j-5855-hjpm |
- Apache Karaf VendorApache Affected Apache Karaf version prior to 4.2.3 Fixed in — No fix listed CNA
- org.apache.karaf:karaf (Maven) Vendor— Affected before 4.2.3 Fixed in 4.2.3 Patch available GHSA-869j-5855-hjpm
- org.apache.karaf:apache-karaf (Maven) Vendor— Affected before 4.2.3 Fixed in 4.2.3 Patch available GHSA-869j-5855-hjpm
Remediation
- Fix · GHSA-869j-5855-hjpm org.apache.karaf:karaf (Maven) Fixed in 4.2.3 Advisory →
- Fix · GHSA-869j-5855-hjpm org.apache.karaf:apache-karaf (Maven) Fixed in 4.2.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Fuse 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0191
- 2026-10-03 Alias added: GHSA-869j-5855-hjpm
References
Advisory 2
Other 4
- [karaf-user] 20190307 [SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf
- [karaf-commits] 20190506 [karaf-site] branch trunk updated: Publish CVE-2019-0226
- https://lists.apache.org/thread.html/6856aa7ed7dd805eaf65d0e5e95027dda3b2307aacd1ab4a838c5cd1@%3Cuser.karaf.apache.org%3E
- https://lists.apache.org/thread.html/cef9a2d4b547625e5214684283ac5c59c9d9740e092e777dc3f85070@%3Ccommits.karaf.apache.org%3E
More Apache Karaf vulnerabilities
- TI-2022-19035 Apache Karaf: JDBC JAAS LDAP injection CVSS 3.1CRITICAL 9.8
- TI-2018-08445 XML external entity injection in Apache Karaf CVSS 3.0CRITICAL 9.8
- TI-2026-61863 Missing authorization in Apache Karaf CVSS 3.1CRITICAL 9.8
- TI-2026-61851 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation CVSS 3.1CRITICAL 9.8
- TI-2020-17076 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. CVSS 3.1HIGH 8.1
- TI-2026-61846 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) CVSS 3.1HIGH 8.8
Sources
- CVE-2019-0191 · CVE Program
- CVE-2019-0191 · NVD
- FIRST EPSS
- GHSA-869j-5855-hjpm · GitHub Advisory Database · CC BY 4.0
- CVE-2019-0191 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences