karaf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From jbono...@apache.org
Subject [karaf-site] branch trunk updated: Update CVE with clearsign
Date Thu, 03 Jan 2019 06:59:02 GMT
This is an automated email from the ASF dual-hosted git repository.

jbonofre pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/karaf-site.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 1eb9bab  Update CVE with clearsign
1eb9bab is described below

commit 1eb9bab5714c44d8ffa851e5eadd882c546c5f72
Author: Jean-Baptiste Onofré <jbonofre@apache.org>
AuthorDate: Thu Jan 3 07:58:51 2019 +0100

    Update CVE with clearsign
---
 src/main/webapp/documentation.html          |  4 +++
 src/main/webapp/security/cve-2014-0219.txt  | 45 +++++++++++++++++++++++++++++
 src/main/webapp/security/cve-2018-11787.txt | 19 ++++++++++++
 3 files changed, 68 insertions(+)

diff --git a/src/main/webapp/documentation.html b/src/main/webapp/documentation.html
index 3ed1e6f..10853fb 100644
--- a/src/main/webapp/documentation.html
+++ b/src/main/webapp/documentation.html
@@ -361,6 +361,10 @@
 								<p>CVE-2018-11787 : Unsecure access to Gogo shell in the webconsole.</p>
 								<a class="btn btn-outline-primary" href="security/cve-2018-11787.txt">Notes
&raquo;</a>
 							</div>
+              <div class="pb-4 mb-3">
+                <p>CVE-2014-0219 : Apache Karaf enables a shutdown port on the loopback
interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown
command to all listening high ports.</p>
+                <a class="btn btn-outline-primary" href="security/cve-2014-0219.txt">Notes
&raquo;</a>
+              </div>
 
             </div><!-- /.blog-main -->
         </div>
diff --git a/src/main/webapp/security/cve-2014-0219.txt b/src/main/webapp/security/cve-2014-0219.txt
new file mode 100644
index 0000000..b26f072
--- /dev/null
+++ b/src/main/webapp/security/cve-2014-0219.txt
@@ -0,0 +1,45 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+CVE-2014-0219: Apache Karaf bind shutdown port on loopback interface
+
+Severity: Minor
+
+Vendor: The Apache Software Foundation
+
+Versions Affected:
+
+This vulnerability affects all versions of Apache Karaf prior to 4.0.10
+
+Description:
+
+Apache Karaf enables a shutdown port on the loopback interface, which 
+allows local users to cause a denial of service (shutdown) by sending 
+a shutdown command to all listening high ports.
+
+This has been fixed in revision:
+
+https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=99365a3
+
+Migration:
+
+Apache Karaf users should upgrade to 4.0.10 or later and disable the
+shutdown port.
+
+Credit: This issue was reported by Colm O hEigeartaigh of Talend.
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCAAdFiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAlwtsiQACgkQv/LuQsgo
+LnbrIg/6ApxUUR0cY7x/n5eM6fCP3io1+vmVineUIhBwu5H97jKBvtTWkNrWoAAv
+tovNuYZVykyOpqBGu/Y4T/G5ryox1MaYV8jP7dad7I4wgqxSXFucoxRvSXr6jjAz
+zF3rxHlGw1b0aKQDZgHBv8vcbbVtw6rE6opKdjwN/C4LCDojVhQQbmSlj+oCIAJI
+JVns9NMpo8VY3btYs0OizmqTtOoKUHkmy4Jy1Fpolsv4KRZrsmvTntPoEYLrjbUy
+5xKu/fTGEstJWhOi66xtSPfM+KwDfPVbvmu8QDxQldl6mjPBAQMwhYQSzz6ubNEF
+3rN4zx80r/cPBQbflaiYnoLuJPhJzdUxgxPAuvvq//t7RCKdS+zMQ2pkxXt0W8p1
+9WVhaVhfQmZf+RoRMnrHcNlvV5EXLRyTfegRScd7+8iPESESi9qnOU2x8JuoqKWc
+K1RY94ZD9wdbLh4HqnrqsaYZFrmJ3QXusrSqlioTltjlBE8E9BOVHnvsRnv6kp+S
+2r+57iauD7SdMtuMuBPTFc9FOHR3DhTm6dYTiuLp7jdwRA8zRX67oTIh17D9zGH9
+YC9B61Rq8ofhoVoRQukfEDkhh423/Oi6IUijPmSPF0dV7nRFd27WadagFFQVfgl3
+s2ktdT89ER72fyEi99Qp4tMtY6P9bfblIlt5HyuTxhUTRjzf05k=
+=MziI
+-----END PGP SIGNATURE-----
diff --git a/src/main/webapp/security/cve-2018-11787.txt b/src/main/webapp/security/cve-2018-11787.txt
index 57ec837..93103d6 100644
--- a/src/main/webapp/security/cve-2018-11787.txt
+++ b/src/main/webapp/security/cve-2018-11787.txt
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
 CVS-2018-11787: Apache Karaf unsecure access to Gogo shell in the webconsole
 
 Severity: Moderate
@@ -41,3 +44,19 @@ or later as soon as possible.
 JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-4993
 
 Credit: This issue was reported by Kevin Schmidt
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCAAdFiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAlwtsoQACgkQv/LuQsgo
+LnaFTg//d5auXMS+5PBBDyNIqY6MVpBEWEqAgeir2eBBtj5vqACSRQh3+QcUFWAt
+a/nZpj6A/BNiuWDR5vYpbgmX0ywyPys7DHdJ8icoFzhqygZpm0UqTLhqKtgjHWy4
+SDBPQWbcybp5n+xXw2R6XoMvf2N3o9iGB/AjDXjPUqehMEfjUvlhfnqlJkurW0PH
+1TrgaP6IAUGk6bAijvQB7SuxUCJ1G+G6uFON7bT3J+5Ctj+kcLYUcCwKNJMFVXHg
+sbTB8GoG0U7wyA40+pTfhD4CeFAwmnT4LxXOSkJKIKNh11YNmBacxSu/7y/hQ8PS
+hRaoodHVQTnYV1kZZLsFR+W0s3uj5splfgucK37oIOIj8rvNSo/lZicgvG7k+2a+
+up0pBMja6DXJFHSFJT4HwTUQoaSbFdqdz4Oy+eZkiQfvyCGGlaaqi9EHb1uxS7ss
+/lGQbDQnKGNtIwNZgKxLtxv/Zcm95paMVGAQ7kiiIKYTnt68nMSmZGN+FJzQIWle
+HBapQAvd12HP6QHdsPACQTZKyCUkwa7sR5kM45gvyzx4jMTZqL9yaMcwK1VsBaRW
+lnlUmGBA5Zak3h01BdNrlDgK1R/iBPFtbnaWFf4UFsOfK5B4CtTClRkqGIF9N2VC
+/hcor/IbA9wSXJH7sR1mAvbt8dEGHHOAGDkPzQnpBWdCcr9j/pY=
+=1dSW
+-----END PGP SIGNATURE-----


Mime
View raw message