This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/karaf-site.git
The following commit(s) were added to refs/heads/trunk by this push:
new 1eacdb7 Add CVE-2026-91006 and cleanup previous CVEs
1eacdb7 is described below
commit 1eacdb7852c93e8ee147f4ceea49b6f7774aca57
Author: JB Onofré <[email protected]>
AuthorDate: Mon Sep 28 11:23:09 2026 +0200
Add CVE-2026-91006 and cleanup previous CVEs
---
security/cve-2026-90979.txt | 32 ++++++++++++++--------------
security/cve-2026-91006.txt | 51 +++++++++++++++++++++++++++++++++++++++++++++
security/cve-2026-92230.txt | 32 ++++++++++++++--------------
3 files changed, 83 insertions(+), 32 deletions(-)
diff --git a/security/cve-2026-90979.txt b/security/cve-2026-90979.txt
index 0bd6826..617f393 100644
--- a/security/cve-2026-90979.txt
+++ b/security/cve-2026-90979.txt
@@ -7,7 +7,7 @@ Severity: moderate
Affected versions:
-- - Apache Karaf before 4.4.12
+- - - Apache Karaf before 4.4.12
Description:
@@ -33,21 +33,21 @@ References:
https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90979
-https://issues.apache.org/jira/browse/https://github.com/apache/karaf/pull/2880
+https://github.com/apache/karaf/pull/2880
-----BEGIN PGP SIGNATURE-----
-iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6KqkbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52FYsP/jHyhtgz9OzCBDlLTmGd
-3LtbWCncdA71eK2vm7HNR8Fob4kdPEWiETuUNr13/pT63j37xPV0h7K2FFKrUaLy
-3TnLQffOsZKICbEcJGM5RgAyYpL58mUy3BAmM4lwiRYHrZvTL7J1JVpHbgWatZ3v
-9MmF+bxTOj1kCf35bSdIV9vgnaEAcaZuaP4+0xlh4yBZP4Cnsj8xjo1LpxBSgcbu
-p5qRYMSqNn+f9g8hSl448yDUON807g/6pIg5gukCRSo4iR8UsvPemqik0lXefr4b
-mhl6d01W+Ywa+THcir4w5kqbA4Jgk++wK0S0GnepWgEkz3i8cUmZR2bZgTSurhgT
-SvIG6SLK8yFNi3fqgKrRozzkF9jGS1pYCsAvsAXLiOJm7xjSxylcTiwhCaFc1tD/
-ljPujiWJ8iGOtq+ZQXkj/0kjmTAge8xR63JTnxjDpooI4KdNsf6D0m8i4HVlzkB1
-Wfq+OAJtfV/SvZp8gDfg8R69RxyvBpqUEY+S58TiUaqZ3RZK/OSbcRS4PdFYHlPK
-1GpsVizprHAbS44yS4IEJ9tj51shlg1kje8WKMJdxhCzNtRzImX+AaE3GRhQ5tT5
-3aVkP+YbCdMzcgG041OvLl6NXuZsH+bk/14jRiYlO4yarmg3EITiYqOFuHgG8gv4
-mHX7tEgpcWosPBCHh8VLrrgc
-=U09B
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MVkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52Zc8P/jmx1PRaqe1w//eK3E8N
+JNiJ+QHBwlH6+Rax2a82H2ccbnbOc0yX7arE9ixKZFOdO+gsaVyzHpKAk52VNJWQ
+jmGbrgrLQiscA3bGN1uzhD4Ng1qdFgivc+kpXRoLOYW/XhjI9k5HZO/9/95RkEik
+3sb11Eo6yIwjQwB9R/SPqYz1WiPukoyg345tZpqrUInGfG00ofPZrsqbkzOcXNrS
+QY+U6g+8VEkwOuMtqOIAFRgNE/esOQ6WlC9ppsnVsRZHV2GmNIx45q1pJegoW3z1
+SLbUPfzyI8z6TErm4uQNAyAVlhMIgIuLGzW+xqzveWMfLuDQIm/8MJwuQ9EQwYoi
+/tYxdZ0JQdn7fFfhVYwvQW1i6sHodbKV3kcALM0fnHrSUk8jthu1bhb/zSY1F5T0
+bJq5TPBpiNWpnhF/UkEXEZt9jsmFq5NGEqgFs+Eau1axzjfgPkZggdMvZOAWZoJx
++FVWS96IidqP0crP9op6uxBzGcLdaFk9EhaVuU3f+Kie6jmvWR1z7bZBTHzib9Ww
+m46qrMl1ARrOvJyOgXiQvUIvZ1OYU4UhfFr7geC0M860qFV9cgrkhHTUg+soYAxD
+6wzYiMi1qTVKeVMAt56LfFcsG3HotG3y7LvmICqb9e9kdckI3d6MUTYeJBsd4OeN
+n6qWrl75UMdkINSvbyxLAoRM
+=6avn
-----END PGP SIGNATURE-----
diff --git a/security/cve-2026-91006.txt b/security/cve-2026-91006.txt
new file mode 100644
index 0000000..c7a745b
--- /dev/null
+++ b/security/cve-2026-91006.txt
@@ -0,0 +1,51 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch
(instance:* / InstancesMBean)
+
+Severity: moderate
+
+Affected versions:
+
+- - Apache Karaf (org.apache.karaf:org.apache.karaf.instance.core) before
4.4.12
+
+Description:
+
+Apache Karaf's instance-management service (InstanceServiceImpl) builds the
command line used to launch a child Karaf JVM by string concatenation, then
executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied
javaOpts value is spliced into that string unquoted. A javaOpts value
containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell
instead of being passed to the JVM as an option, giving arbitrary OS command
execution as the Karaf process user.
+
+Reachable via the shell commands instance:create, instance:start,
instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX
operations (createInstance, startInstance, changeJavaOpts, cloneInstance).
+
+Mitigation
+ * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties
to close the fail-open gap for all unconfigured command scopes.
+ * Restrict which principals can reach instance:* commands and
InstancesMBean via etc/users.properties role assignments.
+ * Treat javaOpts passed to
instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted
input only from fully-trusted operators.
+
+This issue is being tracked as https://github.com/apache/karaf/pull/2878
+
+Credit:
+
+n0mi1k <[email protected]> (reporter)
+
+References:
+
+https://karaf.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-91006
+https://github.com/apache/karaf/pull/2878
+
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MW0bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52Y3MP/RKanIhBGaEY2ZMfdgSx
+yqwfM3VICAo7sfQozD0U9GV3zLPAQxO6OXpaKFjbck1qr5X8BIAwMWdUS3DaFvdK
+XETWmrXfL7GOGGN+lRTCPO+be/cQiEN9DFELlpYq/7TGH98QKEdvRhSwIG9leBjf
+8FmeVo9uPYVs5JC3MAHDjWV25SbyF5RQ3gas40B+9rvzbNkzAhfQmP98TSROTIFL
+caA60jv0qaAfVVXiykELLMSqWp0xQNIhj3N5BQwPW71Zwn09TFFB5RMDvs5DzBAi
+hN5s77T13KHWJIQIY/iYHrdDLF3H6AD6c4xMzes+a0rxkZ4y2Y6nnZegbh4JsLV6
+N0ZqefybEQRTC2HGgLt0YrE46JOyJRvNHdpNkmhFbb0eZL/KSsARGYzXTbiz9Olg
+S7ZWBP8ZCnvat6uAcahNXFxwik7IBO6d/kfZEEFaidq0BA1GAoPudlHBM9q3MJe2
+EKGEFvIfCuAG6lWgFdAfO7F8Ra3+yqfcSLgFXYc+hhHE7ZVQEuRsjaHyOU3Mf4Q2
+yeqSVdc9miAg+/mesd3q+VvqCOvjFg7p4KxKlou+Lq7femgK4/E1lxjZl8kdhW2+
+N4ssj6yUqQxz2kLkQtFdIEseF0nOgzP1UMNAmnm0Lu4jlp2C7X8c9ntLDQYAUm1S
+Nl20y1+BhbqfU8vUpYMcLT0W
+=Em1Z
+-----END PGP SIGNATURE-----
diff --git a/security/cve-2026-92230.txt b/security/cve-2026-92230.txt
index 48a37d6..d81fb29 100644
--- a/security/cve-2026-92230.txt
+++ b/security/cve-2026-92230.txt
@@ -7,7 +7,7 @@ Severity: moderate
Affected versions:
-- - Apache Karaf before 4.4.11
+- - - Apache Karaf before 4.4.11
Description:
@@ -23,21 +23,21 @@ References:
https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-92230
-https://issues.apache.org/jira/browse/https://github.com/apache/karaf/issues/2278
+https://github.com/apache/karaf/issues/2278
-----BEGIN PGP SIGNATURE-----
-iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmqr6nIbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52p40P/R3b/84TGGjSpBGLsQSJ
-V+jUn7PXGPkNx25f3osUYXhB0s1HaaQ9BNWiUMCEa0F8l8+NB8AMYoZFC1KGlDKD
-dTps6yEH5nSmcHwa46MguO/27V9W1KozEvsA0VZ9dcvTrT2Qv52KSWDZahPo79xS
-CyBKcncw846wTo02CPXFlVkDI/EmIYm2UXdIGY1HVGBAG6/C3XvfYY4+iCHP5CXL
-PiAU8b2oWl6kI7+7sRCMI6EW7M0vutLv6cznKNvK0xfCt29aHaMH6nMtAROmWzYp
-x8xdU3m9b/2WoeGDp2mHOx2W2hC2u3OrE1opswRIra8aiLhvLXiaLqlzxebhZn5r
-8tJyfovAo01brIF2p0Maocrd5t6rNFlTXVFdb+2pmU/a7qSSRxg/9CYL/kMCdeB1
-UNk+0gFNxCIQPLaEM8wR4T+m20tZ2AnQfCzT4ihxtqYCcxwIBsQ+S0QPdXSmmyCB
-vZGs6nK0qI117GHsVyG8d+Pf929256IU7AXMKu4PzPGDXQrZyBzOSV+/PiuMAaBK
-sk9tOhOqm/sEFw2c7/LaW1msy+K1RGjxTYWuD0KasvVrQY0nPt+ORUhlwC0GhoTs
-RcuR7B3QOYVu++ULiGMKWnJg86XM+OoCHRaMrQN1DieCNFgf/tmPqFBx7Q8weY1Z
-kcn3yO9M9UjYFzqs8pbQpjme
-=vee7
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MWUbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52RSAP/RVRD/kTGkCQlMsXd05E
+tIK6rnmCtIp+EAG+xd2O/z2Y4xBbkj3O6GZBE575KY3IRWGemkFXaaVIo1b9eW4u
+v4KVagHH84UozvNNHR0M/nYn5Z8l/z0j4stNr32lvjx86WRKrYuiWEpEFVMVijLG
+LLd0qbcOUJ/6CS0fSvPMT0aau9u8Gl8oorwrZT0KUiwEiNfQygoFYOoWCSetilmf
+/t4AWwWMcbisqBsgz8zxx+lfKCj+pDUkHocPOgqDtm+0fCkvDB2OgpV4RPaR3/eQ
+PzY/m1nru95TjKgZOxYDd+3v92HdkMShJPb8b3nZv9BOAQbs4ZVfOGZkxfBO4GsE
+Kur/NpC3Ktwl9NFXcCJrDaEJeDBp2xuzPdcURkoDWj9lbBjTmMvKQZsdyCF012EB
+xHPz2ht3UikvJuBodyX2GvVtcqNV5wnhq29+4vCXfoBPmJV/HTD82Fb8G0lgJJqK
+fcyIoDcz8UdxupyKl58vTmhPvobE/AZEIWPB1r10WMRMwYhTG7ve5bN8Uk3l1gmq
+IJv/pM5XBHQX0NQzO7UiUzySQFV0Na4UsM/5Lh1yvU6vi+TXsQp85bz+B5K3vsR7
+YUoDUqmXDWcNR64QkMFbyS1mtGWj+Ze9cCOMn2dcVAwGIjIuiWS28Yl2osXS2MWf
+mvRlyktEpIegJnEyN4uoM4n8
+=3bsH
-----END PGP SIGNATURE-----
