Homepage

Improper Input Validation Affecting opendaylight package, versions *

Severity

 Recommended
low

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.08% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-OPENDAYLIGHT-5246156
  • published27 Mar 2023
  • disclosed7 Mar 2019
Report a new vulnerability Found a mistake?

Introduced: 7 Mar 2019

CVE-2019-0191  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:7 opendaylight.

NVD Description

Note: Versions mentioned in the description apply only to the upstream opendaylight package and not the opendaylight package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.