High severity · published Mar 30, 2020
CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Graalvm · Oracle
19.3.2; 20.1.0 · source: NVD
NE
Netbeans · Apache
through 11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17561
Mailing List
https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
More from Netbeans
9.8
CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed
9.8
CVE-2018-17191
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE)
9.1
CVE-2019-17560
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads