PT-2019-11963 · Robocode · Robocode

Published 2019-03-30 · Updated 2025-12-22 · CVE-2019-10648

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Robocode versions prior to 1.9.3.6

Description The issue allows remote attackers to cause external service interaction, specifically DNS queries, by leveraging a .openStream call within java.net.URL. This can be demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone.

Recommendations For Robocode versions prior to 1.9.3.6, update to version 1.9.3.6 or later to resolve the issue.

Fix

Missing Authorization

RCE

Weakness Enumeration

CWE-862

CWE-20

Related Identifiers

CVE-2019-10648

GHSA-Q2XP-75M7-GV52

Affected Products

Robocode

References · 12

• https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f · Patch
• https://ubuntu.com/security/CVE-2019-10648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10648 · Security Note
• https://osv.dev/vulnerability/GHSA-q2xp-75m7-gv52 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10648 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10648 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10648 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10648 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10648 · Vendor Advisory
• https://github.com/advisories/GHSA-q2xp-75m7-gv52 · Note
• https://t.me/cveNotify/146551 · Telegram Post
• https://sourceforge.net/p/robocode/bugs/406 · Note