Critical CVE in apache felix dependency present in karaf assemblies

[janpaul1988]

Our vulnerability check tool is blocking all Apache Karaf artifacts (at least assembly) from the line 4.4.x (at least)

https://www.cve.org/CVERecord?id=CVE-2025-25247

There is a critical CVE (9.8) from Apache Felix webconsole (cross site scripting), affected from Version 4.x through 4.9.8
affected from Version 5.x through 5.0.8

Is it possible to fix this issue (backwards?) by upgrading the felix version?

[jbonofre]

Thanks. I will take a look (I think it's already updated).

[jbonofre]

FYI, we can't upgrade to Felix 4.9.x as it would required jakarta.servlet update (requiring Pax Web bump).
I can do a quick fix for XSS tweaking with Private-Package. Let's give a try.

[janpaul1988]

Another example of this is the default distribution, which still has a vulnerable version of webconsole it seems (4.8.12),
https://mvnrepository.com/artifact/org.apache.karaf/apache-karaf/4.4.11/dependencies

I guess the weird thing is that the CVE in maven central is flagged upwards in the dependency chain? This blocks the possiblity of applying a bom override ourselves because we can never get the artifact even though in real time i would use it without vulnerabilities.

[jbonofre]

@janpaul1988 my PR is fixing the actual security issue but it doesn't change the dependency, simply because it's not possible (due to Pax Web/Java requirement on the 4.4.x branch). So, even if the scanners might complain about the dependencies, there's no vulnerability in Karaf with the PR.