CVE-2018-11786

{"containers": {"cna": {"affected": [{"product": "Apache Karaf", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "prior to 4.2.0 release"}]}], "datePublic": "2018-09-18T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user."}], "problemTypes": [{"descriptions": [{"description": "Process Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-09-18T13:57:02.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11786 released for Apache Karaf", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://issues.apache.org/jira/browse/KARAF-5427"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://karaf.apache.org/security/cve-2018-11786.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "DATE_PUBLIC": "2018-09-18T00:00:00", "ID": "CVE-2018-11786", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Karaf", "version": {"version_data": [{"version_value": "prior to 4.2.0 release"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Process Execution"}]}]}, "references": {"reference_data": [{"name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11786 released for Apache Karaf", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9@%3Cdev.karaf.apache.org%3E"}, {"name": "https://issues.apache.org/jira/browse/KARAF-5427", "refsource": "CONFIRM", "url": "https://issues.apache.org/jira/browse/KARAF-5427"}, {"name": "http://karaf.apache.org/security/cve-2018-11786.txt", "refsource": "CONFIRM", "url": "http://karaf.apache.org/security/cve-2018-11786.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T08:17:09.221Z"}, "title": "CVE Program Container", "references": [{"name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11786 released for Apache Karaf", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://issues.apache.org/jira/browse/KARAF-5427"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://karaf.apache.org/security/cve-2018-11786.txt"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2018-11786", "datePublished": "2018-09-18T14:00:00.000Z", "dateReserved": "2018-06-05T00:00:00.000Z", "dateUpdated": "2024-09-17T02:12:17.084Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Apache Karaf", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "prior to 4.2.0 release"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D3FA367-889F-4162-9CB6-E3188A213BCD", "versionEndExcluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user."}, {"lang": "es", "value": "En Apache Karaf en versiones anteriores a la 4.2.0, si el servicio sshd en Karaf se deja activo para que un administrador pueda gestionar la instancia en ejecuci\u00f3n, cualquier usuario con derechos en la consola Karaf puede pivotar y leer/escribir cualquier archivo en el sistema de archivos al que el usuario del proceso Karaf tiene acceso. Esto puede bloquearse parcialmente empleando chroot para cambiar el directorio root para proteger archivos fuera del directorio de instalaci\u00f3n de Karaf; puede bloquearse a\u00fan m\u00e1s definiendo una pol\u00edtica de gesti\u00f3n de seguridad que limite el acceso del sistema de archivos a esos directorios en el inicio de Karaf que son necesarios para que el sistema se ejecute. Sin embargo, esto sigue permitiendo que cualquiera con acceso ssh al proceso Karaf lea y escriba un gran n\u00famero de archivos como el usuario del proceso Karaf."}], "id": "CVE-2018-11786", "lastModified": "2026-06-17T01:36:35.970", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-09-18T14:29:00.357", "references": [{"source": "security@apache.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://karaf.apache.org/security/cve-2018-11786.txt"}, {"source": "security@apache.org", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://issues.apache.org/jira/browse/KARAF-5427"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://karaf.apache.org/security/cve-2018-11786.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://issues.apache.org/jira/browse/KARAF-5427"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "karaf: SSH RBAC security enforcement", "id": "1631102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1631102"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-862", "details": ["In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.", "In Karaf prior to version 4.2.0, arbitrary file read and write, in additional to arbitrary command execution, is possible via the Karaf ssh console, if enabled."], "name": "CVE-2018-11786", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "karaf", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_amq:6", "fix_state": "Out of support scope", "package_name": "karaf", "product_name": "Red Hat JBoss A-MQ 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "karaf", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6", "fix_state": "Will not fix", "package_name": "karaf", "product_name": "Red Hat JBoss Fuse Service Works 6"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Will not fix", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack:12", "fix_state": "Will not fix", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 12 (Pike)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:8", "fix_state": "Will not fix", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 8 (Liberty)"}, {"cpe": "cpe:/a:redhat:openstack:9", "fix_state": "Will not fix", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 9 (Mitaka)"}], "public_date": "2018-09-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-11786\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-11786\nhttp://karaf.apache.org/security/cve-2018-11786.txt"], "statement": "Open Daylight: The SSH console is enabled by default, with default credentials, and allows arbitrary file read and write, in addition to arbitrary command execution, in addition to regular Open Daylight Karaf functions.", "threat_severity": "Moderate"}

{}