PT-2019-11181 · Apache+1 · Apache Jmeter+1

Publicado 2019-03-06 · Atualizado 2020-08-24 · CVE-2019-0187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache JMeter versions prior to 5.1

Description: The issue allows for unauthenticated remote code execution when JMeter is used in distributed mode. An attacker can establish a connection to a jmeter-server and proceed with an attack using untrusted data deserialization. This issue only affects tests running in distributed mode. It is also noted that versions before 4.0 lack the ability to encrypt traffic between nodes and authenticate participating nodes.

Recommendations: For versions prior to 5.1, upgrade to JMeter 5.1 to resolve the issue. As a temporary workaround, consider restricting the use of distributed mode until the upgrade is applied. Additionally, restricting access to the RemoteJMeterEngine can help minimize the risk of exploitation.

Correção

RCE

Use of a Broken Cryptographic Algorithm

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-327

CWE-502

Identificadores relacionados

CVE-2019-0187

GHSA-WG37-7MRV-CFWM

Produtos afetados

Apache Jmeter

Debian

Referências · 15

• https://security-tracker.debian.org/tracker/CVE-2019-0187 · Aviso do Fabricante
• http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wg37-7mrv-cfwm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-0187 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0187 · Nota de Segurança
• http://securityfocus.com/bid/107219 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0187 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-0187 · Aviso do Fabricante
• https://packages.debian.org/src:jakarta-jmeter · Nota
• https://github.com/advisories/GHSA-wg37-7mrv-cfwm · Nota
• https://security-tracker.debian.org/tracker/source-package/jakarta-jmeter · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-0187 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-0187 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-0187 · Nota de Segurança
• https://bz.apache.org/bugzilla/show_bug.cgi?id=62743 · Nota