{"action":"Upgrade org.apache.karaf:apache-karaf to 4.3.8 (4.3.x) or 4.4.2 (4.4.x) or later.","affected":[{"fixed":"4.3.8","introduced":"0"},{"fixed":"4.4.2","introduced":"4.4.0"}],"component":"org.apache.karaf:apache-karaf","cve_ids":["CVE-2022-40145"],"ecosystem":"Maven","epss":0.02596,"exploited":false,"fixed_versions":["4.3.8","4.4.2"],"ghsa_id":"GHSA-c2p4-8mvv-rwmv","id":"tcs_01M5N8R71TTTPKWRAZXGKX1MG3","modified_at":"2025-04-15T18:55:39.395392Z","published_at":"2022-12-21T18:30:22Z","references":["https://osv.dev/vulnerability/GHSA-c2p4-8mvv-rwmv","https://nvd.nist.gov/vuln/detail/CVE-2022-40145","https://github.com/apache/karaf/pull/1632","https://gitbox.apache.org/repos/asf?p=karaf.git;h=2a933445d1","https://gitbox.apache.org/repos/asf?p=karaf.git;h=3819f48341","https://github.com/apache/karaf","https://issues.apache.org/jira/browse/KARAF-7568","https://karaf.apache.org/security/cve-2022-40145.txt"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-c2p4-8mvv-rwmv","url":"https://osv.dev/vulnerability/GHSA-c2p4-8mvv-rwmv"}],"summary":"Apache Karaf vulnerable to potential code injection"}