{"action":"Upgrade org.apache.karaf.management:org.apache.karaf.management.server to 4.3.6 or later.","affected":[{"fixed":"4.3.6","introduced":"0"}],"component":"org.apache.karaf.management:org.apache.karaf.management.server","cve_ids":["CVE-2021-41766"],"ecosystem":"Maven","epss":0.02033,"exploited":false,"fixed_versions":["4.3.6"],"ghsa_id":"GHSA-jh5g-9m4v-9vv9","id":"tcs_01M5N92ZEQ020W23ZA2K644WYD","modified_at":"2024-02-16T08:13:23.445279Z","published_at":"2022-01-28T22:24:48Z","references":["https://osv.dev/vulnerability/GHSA-jh5g-9m4v-9vv9","https://nvd.nist.gov/vuln/detail/CVE-2021-41766","https://github.com/apache/karaf/pull/1475","https://github.com/apache/karaf/commit/b42c82ca3b9a22bd92d249a1060a1953f4188bc2","https://gitbox.apache.org/repos/asf?p=karaf.git;h=93a019c","https://gitbox.apache.org/repos/asf?p=karaf.git;h=b42c82c","https://github.com/apache/karaf","https://issues.apache.org/jira/browse/KARAF-7312","https://karaf.apache.org/security/cve-2021-41766.txt"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-jh5g-9m4v-9vv9","url":"https://osv.dev/vulnerability/GHSA-jh5g-9m4v-9vv9"}],"summary":"Insecure Java Deserialization in Apache Karaf"}