CVE-2019-10086
Aliases:GHSA-6phf-73q6-gh87DEBIAN-CVE-2019-10086CGA-2463-88q5-mqg2CGA-27qh-jgg7-xh9vCGA-2rr7-6m75-8p28CGA-3285-4xvh-vhw3CGA-32mf-9cf7-3qvhCGA-359f-fwc7-8hh7CGA-36h7-3q29-ppc2CGA-37mj-w3h5-xgg4CGA-37rw-hm6j-g8p9CGA-3cqq-m429-m8x7CGA-3j9j-vhhq-7586CGA-478c-9j92-rmrqCGA-4mw4-cjch-4cq2CGA-4rh8-g9q5-c7gjCGA-53hc-gqmx-3x36CGA-57v2-x3jh-rr25CGA-585v-hv52-69wvCGA-5ggm-8vv8-32g8CGA-5w75-c5r3-57f8CGA-64x8-9c5f-qpcqCGA-69qp-x7qr-x5w4CGA-6cg3-qmv8-737cCGA-6cgv-54pj-c7cvCGA-743r-pwcw-pmpfCGA-7555-w6vv-74qwCGA-7892-mv3f-wrg8CGA-7f5q-p39h-wj2pCGA-7fq6-gx2x-xqxvCGA-7p83-ffqf-gq37CGA-7p8q-22r2-p4jxCGA-7pcc-xhvc-7qxcCGA-7pq6-9prm-pxf2CGA-7qg8-cgjf-4g4jCGA-7wv7-v2h6-hj3hCGA-83mv-58cc-wv73CGA-84w2-vf8c-4h2xCGA-859j-r2hc-8v7fCGA-8j6f-5g92-43r7CGA-94mc-8m66-q237CGA-9539-p9r4-4pmqCGA-97cj-p9mv-9wr7CGA-9rgg-9vm9-9fhfCGA-c3r8-8pj7-6r2xCGA-c5p9-659p-2w33CGA-c84p-q42w-2jpfCGA-c86q-4782-hxc3CGA-cc6v-88j6-x5qvCGA-cr4v-4f5h-6fgjCGA-f8xp-pmgw-q4hqCGA-fcr2-438q-gmgwCGA-fhgf-p26g-qcw5CGA-g54w-4gh7-4f4mCGA-g7v2-g9j5-m873CGA-gj2w-9cxp-992vCGA-gpp7-6qf7-89mvCGA-grw3-ww26-hhgfCGA-hm4g-749c-m2jxCGA-hqmv-pxx7-p9c5CGA-hr8x-jghp-8wx6CGA-hv5r-7563-c456CGA-j478-h9gx-295jCGA-jgvm-7wfq-hgj8CGA-jjmv-xqw2-x8f4CGA-jrch-g82c-389rCGA-m2w7-j4jc-6xwpCGA-m4hv-23ch-63g8CGA-m4q4-3j33-896vCGA-m578-jxvw-98ggCGA-m58v-2cmr-8j59CGA-m6pm-cjgc-rjh2CGA-m6pv-6f2x-7x23CGA-mcq6-j83w-w3h6CGA-mmv6-4578-mx22CGA-p237-rg33-6fcgCGA-p754-jwrg-wr7rCGA-p7vx-442f-3qhfCGA-p9j3-qcp5-8qh8CGA-pc94-24mv-3w4jCGA-pff5-rcv3-w483CGA-ph27-6fc7-8753CGA-pj4v-m3xj-rjc6CGA-pqhp-28vr-m75fCGA-pw4m-3gh9-mr4jCGA-273r-f87r-6483CGA-648j-3mjp-x6w6CGA-jgv2-jggx-wqc6CGA-mrrp-qw52-rxg2CGA-q57f-j4hh-2mcpCGA-q9xr-55gf-6r29CGA-qcvp-fp37-68r4CGA-qp23-qg74-5crxCGA-qq49-2fq3-3c3gCGA-qxr9-jhm3-r5xhCGA-r3fh-9gvc-6cfmCGA-r4mg-hpr5-4cxcCGA-r5m2-8rqc-pcf3CGA-rc45-ggvw-fjrvCGA-rcxj-8688-xg8hCGA-rg64-j89j-r4ffCGA-rgrw-jc32-x85jCGA-rhqh-3v25-6r3hCGA-v45m-hh7w-p8wrCGA-v7m9-5vh7-q569CGA-v8fj-jrp7-rwm9CGA-v938-rjhr-38ppCGA-vccr-gpg7-rrhgCGA-vcpj-v2c4-7rxwCGA-vh58-prhj-whg3CGA-vm2p-p7f3-2jjwCGA-vvfw-8386-7mjfCGA-vx3q-8gw8-jc99CGA-vxvf-3qf5-g5vgCGA-w326-prc6-6pm7CGA-w473-q2q6-cp5jCGA-whvm-v497-wpr8CGA-whvr-8x9g-9m4wCGA-wv57-hxp4-2674CGA-wwqf-mmfc-vmmpCGA-x2mv-8wxg-w8x7CGA-x4vj-72gj-2wqrCGA-x645-8x73-8864CGA-xc4h-f2g3-v53rCGA-xg8p-cv49-fcpwCGA-xjv5-g3xm-j5f2CGA-xmhf-qw9f-r6gmCGA-xxh9-fx23-m97w
Advisory lineage Upstream: 0 Downstream: 22
Modified
Published: 20 Aug 2019, 20:10
Last modified:04 Aug 2024, 22:10
Vulnerability Summary
Overall Risk (default)
medium
36/100 CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
29.24% HIGH
29% probability +28.92%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
20 Aug 2019, 20:10
Published
Vulnerability first disclosed
04 Aug 2024, 22:10
Last Modified
Vulnerability information updated
Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVSS Metrics
- v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 29.24%• Percentile: 98%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- apache•apache commons beanutils
Apache Commons Beanutils 1.0 to 1.9.3
- apache•commons_beanutils
≥ 1.0, ≤ 1.9.3
- apache•nifi
1.14.0 | 1.15.0
- chainguard•eco-java-gradle-1.11
all
- chainguard•hadoop-fips-3.3.6
< 3.3.6-r15
- chainguard•hadoop-fips-3.4.2
all
- chainguard•hadoop-fips-3.5
all | < 3.5.0-r12
- chainguard•trino
< 439-r0
- chainguard•trino-config
< 439-r0
- chainguard•trino-oci-entrypoint
< 439-r0
- chainguard•trino-plugin-ai-functions
< 439-r0
- chainguard•trino-plugin-bigquery
< 439-r0
- chainguard•trino-plugin-blackhole
< 439-r0
- chainguard•trino-plugin-cassandra
< 439-r0
- chainguard•trino-plugin-clickhouse
< 439-r0
- chainguard•trino-plugin-delta-lake
< 439-r0
- chainguard•trino-plugin-druid
< 439-r0
- chainguard•trino-plugin-duckdb
< 439-r0
- chainguard•trino-plugin-elasticsearch
< 439-r0
- chainguard•trino-plugin-exasol
< 439-r0
- chainguard•trino-plugin-exchange-filesystem
< 439-r0
- chainguard•trino-plugin-exchange-hdfs
< 439-r0
- chainguard•trino-plugin-faker
< 439-r0
- chainguard•trino-plugin-functions-python
< 439-r0
- chainguard•trino-plugin-geospatial
< 439-r0
- chainguard•trino-plugin-google-sheets
< 439-r0
- chainguard•trino-plugin-hive
< 439-r0
- chainguard•trino-plugin-http-event-listener
< 439-r0
- chainguard•trino-plugin-http-server-event-listener
< 439-r0
- chainguard•trino-plugin-hudi
< 439-r0
- chainguard•trino-plugin-iceberg
< 439-r0
- chainguard•trino-plugin-ignite
< 439-r0
- chainguard•trino-plugin-jmx
< 439-r0
- chainguard•trino-plugin-kafka
< 439-r0
- chainguard•trino-plugin-kafka-event-listener
< 439-r0
- chainguard•trino-plugin-lakehouse
< 439-r0
- chainguard•trino-plugin-ldap-group-provider
< 439-r0
- chainguard•trino-plugin-loki
< 439-r0
- chainguard•trino-plugin-mariadb
< 439-r0
- chainguard•trino-plugin-memory
< 439-r0
- chainguard•trino-plugin-ml
< 439-r0
- chainguard•trino-plugin-mongodb
< 439-r0
- chainguard•trino-plugin-mysql
< 439-r0
- chainguard•trino-plugin-mysql-event-listener
< 439-r0
- chainguard•trino-plugin-opa
< 439-r0
- chainguard•trino-plugin-openlineage
< 439-r0
- chainguard•trino-plugin-opensearch
< 439-r0
- chainguard•trino-plugin-oracle
< 439-r0
- chainguard•trino-plugin-password-authenticators
< 439-r0
- chainguard•trino-plugin-pinot
< 439-r0
Showing first 50 affected entries in server-rendered view.
References (94)
- http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e
- https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html
- https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
- https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
- https://access.redhat.com/errata/RHSA-2019:4317
- https://access.redhat.com/errata/RHSA-2020:0057
- https://access.redhat.com/errata/RHSA-2020:0194
- https://access.redhat.com/errata/RHSA-2020:0806
- https://access.redhat.com/errata/RHSA-2020:0811
- https://access.redhat.com/errata/RHSA-2020:0804
- https://access.redhat.com/errata/RHSA-2020:0805
- https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E
- https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-10086
- https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%3E
- https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E
- https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO
- https://github.com/apache/commons-beanutils
- https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc@%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db@%3Cdev.rocketmq.apache.org%3E
- https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825@%3Ccommits.dolphinscheduler.apache.org%3E
- https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E
- http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e
- https://security-tracker.debian.org/tracker/CVE-2019-10086