Author: jbonofre
Date: Mon Sep 28 09:45:52 2026
New Revision: 1938598
Log:
[scm-publish] Updating main website contents
Added:
karaf/site/production/security/cve-2026-91006.txt
Modified:
karaf/site/production/documentation.html
karaf/site/production/feed.xml
karaf/site/production/security/cve-2026-90979.txt
karaf/site/production/security/cve-2026-92230.txt
Modified: karaf/site/production/documentation.html
==============================================================================
--- karaf/site/production/documentation.html Mon Sep 28 09:20:35 2026
(r1938597)
+++ karaf/site/production/documentation.html Mon Sep 28 09:45:52 2026
(r1938598)
@@ -342,15 +342,22 @@
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-92230: Apache Karaf: Improper release of ClassLoader
references via static ThreadLocal caching</p>
- <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-92230.txt">Notes »</a>
+ <p>CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP
login modules</p>
+ <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-90979.txt">Notes »</a>
</div>
</div>
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP
login modules</p>
- <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-90979.txt">Notes »</a>
+ <p>CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance
Launch (instance:* / InstancesMBean) </p>
+ <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91006.txt">Notes »</a>
+ </div>
+ </div>
+ <div class="k-admonition">
+ <div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
+ <div>
+ <p>CVE-2026-92230: Apache Karaf: Improper release of ClassLoader
references via static ThreadLocal caching</p>
+ <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-92230.txt">Notes »</a>
</div>
</div>
Modified: karaf/site/production/feed.xml
==============================================================================
--- karaf/site/production/feed.xml Mon Sep 28 09:20:35 2026
(r1938597)
+++ karaf/site/production/feed.xml Mon Sep 28 09:45:52 2026
(r1938598)
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://karaf.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://karaf.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-09-28T03:55:35-05:00</updated><id>https://karaf.apache.org/feed.xml</id><title
type="html">Apache Karaf - The modulith runtime</title><subtitle>Karaf
provides modulith runtime for the enterprise, running on premise or on cloud.
Focus on your business code and applications, Apache Karaf deals with the
rest.</subtitle></feed>
\ No newline at end of file
+<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://karaf.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://karaf.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-09-28T04:43:43-05:00</updated><id>https://karaf.apache.org/feed.xml</id><title
type="html">Apache Karaf - The modulith runtime</title><subtitle>Karaf
provides modulith runtime for the enterprise, running on premise or on cloud.
Focus on your business code and applications, Apache Karaf deals with the
rest.</subtitle></feed>
\ No newline at end of file
Modified: karaf/site/production/security/cve-2026-90979.txt
==============================================================================
--- karaf/site/production/security/cve-2026-90979.txt Mon Sep 28 09:20:35
2026 (r1938597)
+++ karaf/site/production/security/cve-2026-90979.txt Mon Sep 28 09:45:52
2026 (r1938598)
@@ -7,7 +7,7 @@ Severity: moderate
Affected versions:
-- - Apache Karaf before 4.4.12
+- - - Apache Karaf before 4.4.12
Description:
@@ -33,21 +33,21 @@ References:
https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90979
-https://issues.apache.org/jira/browse/https://github.com/apache/karaf/pull/2880
+https://github.com/apache/karaf/pull/2880
-----BEGIN PGP SIGNATURE-----
-iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6KqkbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52FYsP/jHyhtgz9OzCBDlLTmGd
-3LtbWCncdA71eK2vm7HNR8Fob4kdPEWiETuUNr13/pT63j37xPV0h7K2FFKrUaLy
-3TnLQffOsZKICbEcJGM5RgAyYpL58mUy3BAmM4lwiRYHrZvTL7J1JVpHbgWatZ3v
-9MmF+bxTOj1kCf35bSdIV9vgnaEAcaZuaP4+0xlh4yBZP4Cnsj8xjo1LpxBSgcbu
-p5qRYMSqNn+f9g8hSl448yDUON807g/6pIg5gukCRSo4iR8UsvPemqik0lXefr4b
-mhl6d01W+Ywa+THcir4w5kqbA4Jgk++wK0S0GnepWgEkz3i8cUmZR2bZgTSurhgT
-SvIG6SLK8yFNi3fqgKrRozzkF9jGS1pYCsAvsAXLiOJm7xjSxylcTiwhCaFc1tD/
-ljPujiWJ8iGOtq+ZQXkj/0kjmTAge8xR63JTnxjDpooI4KdNsf6D0m8i4HVlzkB1
-Wfq+OAJtfV/SvZp8gDfg8R69RxyvBpqUEY+S58TiUaqZ3RZK/OSbcRS4PdFYHlPK
-1GpsVizprHAbS44yS4IEJ9tj51shlg1kje8WKMJdxhCzNtRzImX+AaE3GRhQ5tT5
-3aVkP+YbCdMzcgG041OvLl6NXuZsH+bk/14jRiYlO4yarmg3EITiYqOFuHgG8gv4
-mHX7tEgpcWosPBCHh8VLrrgc
-=U09B
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MVkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52Zc8P/jmx1PRaqe1w//eK3E8N
+JNiJ+QHBwlH6+Rax2a82H2ccbnbOc0yX7arE9ixKZFOdO+gsaVyzHpKAk52VNJWQ
+jmGbrgrLQiscA3bGN1uzhD4Ng1qdFgivc+kpXRoLOYW/XhjI9k5HZO/9/95RkEik
+3sb11Eo6yIwjQwB9R/SPqYz1WiPukoyg345tZpqrUInGfG00ofPZrsqbkzOcXNrS
+QY+U6g+8VEkwOuMtqOIAFRgNE/esOQ6WlC9ppsnVsRZHV2GmNIx45q1pJegoW3z1
+SLbUPfzyI8z6TErm4uQNAyAVlhMIgIuLGzW+xqzveWMfLuDQIm/8MJwuQ9EQwYoi
+/tYxdZ0JQdn7fFfhVYwvQW1i6sHodbKV3kcALM0fnHrSUk8jthu1bhb/zSY1F5T0
+bJq5TPBpiNWpnhF/UkEXEZt9jsmFq5NGEqgFs+Eau1axzjfgPkZggdMvZOAWZoJx
++FVWS96IidqP0crP9op6uxBzGcLdaFk9EhaVuU3f+Kie6jmvWR1z7bZBTHzib9Ww
+m46qrMl1ARrOvJyOgXiQvUIvZ1OYU4UhfFr7geC0M860qFV9cgrkhHTUg+soYAxD
+6wzYiMi1qTVKeVMAt56LfFcsG3HotG3y7LvmICqb9e9kdckI3d6MUTYeJBsd4OeN
+n6qWrl75UMdkINSvbyxLAoRM
+=6avn
-----END PGP SIGNATURE-----
Added: karaf/site/production/security/cve-2026-91006.txt
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ karaf/site/production/security/cve-2026-91006.txt Mon Sep 28 09:45:52
2026 (r1938598)
@@ -0,0 +1,51 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch
(instance:* / InstancesMBean)
+
+Severity: moderate
+
+Affected versions:
+
+- - Apache Karaf (org.apache.karaf:org.apache.karaf.instance.core) before
4.4.12
+
+Description:
+
+Apache Karaf's instance-management service (InstanceServiceImpl) builds the
command line used to launch a child Karaf JVM by string concatenation, then
executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied
javaOpts value is spliced into that string unquoted. A javaOpts value
containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell
instead of being passed to the JVM as an option, giving arbitrary OS command
execution as the Karaf process user.
+
+Reachable via the shell commands instance:create, instance:start,
instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX
operations (createInstance, startInstance, changeJavaOpts, cloneInstance).
+
+Mitigation
+ * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties
to close the fail-open gap for all unconfigured command scopes.
+ * Restrict which principals can reach instance:* commands and
InstancesMBean via etc/users.properties role assignments.
+ * Treat javaOpts passed to
instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted
input only from fully-trusted operators.
+
+This issue is being tracked as https://github.com/apache/karaf/pull/2878
+
+Credit:
+
+n0mi1k <[email protected]> (reporter)
+
+References:
+
+https://karaf.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-91006
+https://github.com/apache/karaf/pull/2878
+
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MW0bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52Y3MP/RKanIhBGaEY2ZMfdgSx
+yqwfM3VICAo7sfQozD0U9GV3zLPAQxO6OXpaKFjbck1qr5X8BIAwMWdUS3DaFvdK
+XETWmrXfL7GOGGN+lRTCPO+be/cQiEN9DFELlpYq/7TGH98QKEdvRhSwIG9leBjf
+8FmeVo9uPYVs5JC3MAHDjWV25SbyF5RQ3gas40B+9rvzbNkzAhfQmP98TSROTIFL
+caA60jv0qaAfVVXiykELLMSqWp0xQNIhj3N5BQwPW71Zwn09TFFB5RMDvs5DzBAi
+hN5s77T13KHWJIQIY/iYHrdDLF3H6AD6c4xMzes+a0rxkZ4y2Y6nnZegbh4JsLV6
+N0ZqefybEQRTC2HGgLt0YrE46JOyJRvNHdpNkmhFbb0eZL/KSsARGYzXTbiz9Olg
+S7ZWBP8ZCnvat6uAcahNXFxwik7IBO6d/kfZEEFaidq0BA1GAoPudlHBM9q3MJe2
+EKGEFvIfCuAG6lWgFdAfO7F8Ra3+yqfcSLgFXYc+hhHE7ZVQEuRsjaHyOU3Mf4Q2
+yeqSVdc9miAg+/mesd3q+VvqCOvjFg7p4KxKlou+Lq7femgK4/E1lxjZl8kdhW2+
+N4ssj6yUqQxz2kLkQtFdIEseF0nOgzP1UMNAmnm0Lu4jlp2C7X8c9ntLDQYAUm1S
+Nl20y1+BhbqfU8vUpYMcLT0W
+=Em1Z
+-----END PGP SIGNATURE-----
Modified: karaf/site/production/security/cve-2026-92230.txt
==============================================================================
--- karaf/site/production/security/cve-2026-92230.txt Mon Sep 28 09:20:35
2026 (r1938597)
+++ karaf/site/production/security/cve-2026-92230.txt Mon Sep 28 09:45:52
2026 (r1938598)
@@ -7,7 +7,7 @@ Severity: moderate
Affected versions:
-- - Apache Karaf before 4.4.11
+- - - Apache Karaf before 4.4.11
Description:
@@ -23,21 +23,21 @@ References:
https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-92230
-https://issues.apache.org/jira/browse/https://github.com/apache/karaf/issues/2278
+https://github.com/apache/karaf/issues/2278
-----BEGIN PGP SIGNATURE-----
-iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmqr6nIbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52p40P/R3b/84TGGjSpBGLsQSJ
-V+jUn7PXGPkNx25f3osUYXhB0s1HaaQ9BNWiUMCEa0F8l8+NB8AMYoZFC1KGlDKD
-dTps6yEH5nSmcHwa46MguO/27V9W1KozEvsA0VZ9dcvTrT2Qv52KSWDZahPo79xS
-CyBKcncw846wTo02CPXFlVkDI/EmIYm2UXdIGY1HVGBAG6/C3XvfYY4+iCHP5CXL
-PiAU8b2oWl6kI7+7sRCMI6EW7M0vutLv6cznKNvK0xfCt29aHaMH6nMtAROmWzYp
-x8xdU3m9b/2WoeGDp2mHOx2W2hC2u3OrE1opswRIra8aiLhvLXiaLqlzxebhZn5r
-8tJyfovAo01brIF2p0Maocrd5t6rNFlTXVFdb+2pmU/a7qSSRxg/9CYL/kMCdeB1
-UNk+0gFNxCIQPLaEM8wR4T+m20tZ2AnQfCzT4ihxtqYCcxwIBsQ+S0QPdXSmmyCB
-vZGs6nK0qI117GHsVyG8d+Pf929256IU7AXMKu4PzPGDXQrZyBzOSV+/PiuMAaBK
-sk9tOhOqm/sEFw2c7/LaW1msy+K1RGjxTYWuD0KasvVrQY0nPt+ORUhlwC0GhoTs
-RcuR7B3QOYVu++ULiGMKWnJg86XM+OoCHRaMrQN1DieCNFgf/tmPqFBx7Q8weY1Z
-kcn3yO9M9UjYFzqs8pbQpjme
-=vee7
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6MWUbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52RSAP/RVRD/kTGkCQlMsXd05E
+tIK6rnmCtIp+EAG+xd2O/z2Y4xBbkj3O6GZBE575KY3IRWGemkFXaaVIo1b9eW4u
+v4KVagHH84UozvNNHR0M/nYn5Z8l/z0j4stNr32lvjx86WRKrYuiWEpEFVMVijLG
+LLd0qbcOUJ/6CS0fSvPMT0aau9u8Gl8oorwrZT0KUiwEiNfQygoFYOoWCSetilmf
+/t4AWwWMcbisqBsgz8zxx+lfKCj+pDUkHocPOgqDtm+0fCkvDB2OgpV4RPaR3/eQ
+PzY/m1nru95TjKgZOxYDd+3v92HdkMShJPb8b3nZv9BOAQbs4ZVfOGZkxfBO4GsE
+Kur/NpC3Ktwl9NFXcCJrDaEJeDBp2xuzPdcURkoDWj9lbBjTmMvKQZsdyCF012EB
+xHPz2ht3UikvJuBodyX2GvVtcqNV5wnhq29+4vCXfoBPmJV/HTD82Fb8G0lgJJqK
+fcyIoDcz8UdxupyKl58vTmhPvobE/AZEIWPB1r10WMRMwYhTG7ve5bN8Uk3l1gmq
+IJv/pM5XBHQX0NQzO7UiUzySQFV0Na4UsM/5Lh1yvU6vi+TXsQp85bz+B5K3vsR7
+YUoDUqmXDWcNR64QkMFbyS1mtGWj+Ze9cCOMn2dcVAwGIjIuiWS28Yl2osXS2MWf
+mvRlyktEpIegJnEyN4uoM4n8
+=3bsH
-----END PGP SIGNATURE-----
