jbonofre commented on PR #2893: URL: https://github.com/apache/karaf/pull/2893#issuecomment-5651408309
@holgerfriedrich It's fine to update to Equiinox 3.18.600, but I would like to clarify the CVE reason. The CVE describes RCE via a fork console command reachable over an unauthorized telnet connection to Equinox's console interface. Karaf doesn't use osgi.console from Equinox as we use our own SSH server/shell, not Equinox's built-in console, so we are not vulnerable. So, upgrading to make the scanner happy (people just see that without checking if it's actually vulnerable 😄 ),but we are not fixing the CVE as we are not impacted. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
