PT-2020-4106 · Apache · Apache Netbeans

Filip Ceglik · Published 2020-03-30 · Updated 2023-01-27 · CVE-2019-17560

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Apache NetBeans versions up to and including 11.2

Description: The issue is related to the Apache NetBeans autoupdate system, which does not validate SSL certificates and hostnames for https-based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. The vulnerability may impact the confidentiality and integrity of protected information.

Recommendations: For Apache NetBeans versions up to and including 11.2, consider disabling the autoupdate feature until a patch is available to prevent potential exploitation. Restrict access to the autoupdate system to minimize the risk of malicious code injection. Avoid using the autoupdate system for https-based downloads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2020-04509

CVE-2019-17560

GHSA-7C2M-VWXW-5QWW

Affected Products

Apache Netbeans

References · 15

• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-17560 · Security Note
• https://lists.apache.org/thread.html/r354d7654efa1050539fe56a3257696d1faeea4f3f9b633c29ec89609%40%3Cdev.netbeans.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17560 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17560 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17560 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7c2m-vwxw-5qww · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04509 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17560 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17560 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17560 · Vendor Advisory
• https://t.me/cvenotify/2256 · Telegram Post
• https://t.me/cibsecurity/10841 · Telegram Post
• https://t.me/cvenotify/42976 · Telegram Post
• https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E · Note