CVE-2019-17561

CWE-347CWE-20 — Improper Input Validation6 documents5 sources
Severity
7.5HIGH
EPSS
0.7%
top 27.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache NetbeansOracle Graalvm
Timeline
PublishedMar 30
Latest updateMay 24

Description

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶NVDapache/netbeans11.2
▶CVEListV5apache_netbeansthrough 11.2
▶Debiannetbeans< 12.1-1+3
▶NVDoracle/graalvm19.3.2, 20.1.0+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Improper Verification of Cryptographic Signature in Apache Netbeans↗2022-05-24
▶
GHSA
Improper Verification of Cryptographic Signature in Apache Netbeans↗2022-05-24
▶
OSV
CVE-2019-17561: The "Apache NetBeans" autoupdate system does not fully validate code signatures↗2020-03-30
▶
CVEList
CVE-2019-17561: The "Apache NetBeans" autoupdate system does not fully validate code signatures↗2020-03-30
▶

📋Vendor Advisories

1
Debian
CVE-2019-17561: netbeans - The "Apache NetBeans" autoupdate system does not fully validate code signatures....↗2019
▶
CVE-2019-17561 (HIGH CVSS 7.5) | The "Apache NetBeans" autoupdate sy | cvebase.io