PT-2019-11181 · Apache+1 · Apache Jmeter+1

Published 2019-03-06 · Updated 2020-08-24 · CVE-2019-0187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache JMeter versions prior to 5.1

Description: The issue allows for unauthenticated remote code execution when JMeter is used in distributed mode. An attacker can establish a connection to a jmeter-server and proceed with an attack using untrusted data deserialization. This issue only affects tests running in distributed mode. It is also noted that versions before 4.0 lack the ability to encrypt traffic between nodes and authenticate participating nodes.

Recommendations: For versions prior to 5.1, upgrade to JMeter 5.1 to resolve the issue. As a temporary workaround, consider restricting the use of distributed mode until the upgrade is applied. Additionally, restricting access to the RemoteJMeterEngine can help minimize the risk of exploitation.

Fix

RCE

Use of a Broken Cryptographic Algorithm

Deserialization of Untrusted Data

Weakness Enumeration

CWE-327

CWE-502

Related Identifiers

CVE-2019-0187

GHSA-WG37-7MRV-CFWM

Affected Products

Apache Jmeter

Debian

References · 15

• https://security-tracker.debian.org/tracker/CVE-2019-0187 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wg37-7mrv-cfwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0187 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0187 · Security Note
• https://ubuntu.com/security/CVE-2019-0187 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/jakarta-jmeter · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-0187 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-0187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-0187 · Security Note
• http://securityfocus.com/bid/107219 · Note
• https://packages.debian.org/src:jakarta-jmeter · Note
• https://github.com/advisories/GHSA-wg37-7mrv-cfwm · Note
• https://bz.apache.org/bugzilla/show_bug.cgi?id=62743 · Note