PT-2020-4107 · Apache · Apache Netbeans

Published 2020-03-30 · Updated 2022-05-24 · CVE-2019-17561

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Apache NetBeans versions up to and including 11.2

Description: The issue is related to insufficient validation of input data in the Apache NetBeans autoupdate system, which does not fully validate code signatures. This could allow a remote attacker to modify the downloaded nbm and include additional code, potentially leading to the execution of arbitrary code.

Recommendations: For Apache NetBeans versions up to and including 11.2, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the autoupdate system until a patch is available. Restrict access to the nbm files to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

RCE

Weakness Enumeration

CWE-347

CWE-20

Related Identifiers

BDU:2020-04510

CVE-2019-17561

GHSA-CF8Q-J9H3-7237

Affected Products

Apache Netbeans

References · 13

• https://cve.org/CVERecord?id=CVE-2019-17561 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-17561 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17561 · Security Note
• https://ubuntu.com/security/CVE-2019-17561 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04510 · Security Note
• https://osv.dev/vulnerability/GHSA-cf8q-j9h3-7237 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17561 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17561 · Vendor Advisory
• https://t.me/cvenotify/2257 · Telegram Post
• https://t.me/cibsecurity/10840 · Telegram Post