CVE-2019-2684: apache cassandra
CVSS: 5.9v3.1MediumModified
AliasesUBUNTU-CVE-2019-2684DEBIAN-CVE-2019-2684CGA-2mjp-3pcj-335rCGA-9g5f-5gq2-hqxqCGA-fr68-vhpq-cpq3CGA-wv9c-f8gq-pmqmCGA-26cx-m7mf-r2gjCGA-26pw-fgp6-5m3cCGA-27qg-8fx7-67xmCGA-2w9m-4qh9-7qqpCGA-39cm-95gj-q7h8CGA-4q67-jf8q-8gvfCGA-4rcm-xxv8-85jhCGA-4v4v-5qgc-w2w4CGA-52fx-g744-v4rfCGA-8hw5-p4q8-83xrCGA-8w94-36h6-g8x7CGA-9crq-ggm4-973mCGA-9g33-9rvw-6hj2CGA-9vq2-h3r8-q78mCGA-9x96-2335-h596CGA-c684-h7cm-94m9CGA-ccrx-3fcp-mqf8CGA-h7rv-mqp3-jv84CGA-j768-4pfc-9rq3CGA-jmhp-gr38-mhmxCGA-m4g9-mpvm-hxcgCGA-mg6p-wh65-86j5CGA-mmx9-m3vx-72x3CGA-pmm7-66f8-4j55CGA-qj53-72g7-r8mqCGA-qm72-7cpj-vp5xCGA-vgqp-g3x5-qvg8CGA-vvv7-fcm8-x4j4CGA-vwcv-2x79-57w8CGA-wcp4-jcqr-x977CGA-wgr7-8p66-fxvxCGA-xv63-fcqg-5rj3
Published 23-04-2019Last modified 02-10-2024
Vulnerability summary
CVE-2019-2684 is a medium (CVSS 5.9) vulnerability in apache cassandra. EPSS estimates a 37.62% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (NVD)EPSS score
37.62%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 32 · Related 21DLA-1782-1DSA-4453-1MGASA-2019-0155OPENSUSE-SU-2019:1327-1OPENSUSE-SU-2019:1438-1OPENSUSE-SU-2024:10871-1OPENSUSE-SU-2024:10872-1OPENSUSE-SU-2024:10873-1OPENSUSE-SU-2024:10876-1RHSA-2019:0774RHSA-2019:0775RHSA-2019:0778RHSA-2019:0790RHSA-2019:0791RHSA-2019:1146RHSA-2019:1163RHSA-2019:1164RHSA-2019:1165RHSA-2019:1166RHSA-2019:1238RHSA-2019:1325RHSA-2019:1518SUSE-SU-2019:1211-1SUSE-SU-2019:1211-2SUSE-SU-2019:1219-1SUSE-SU-2019:1308-1SUSE-SU-2019:1308-2SUSE-SU-2019:1345-1SUSE-SU-2019:1392-1SUSE-SU-2019:14059-1SUSE-SU-2019:1644-1USN-3975-1CGA-9689-7F9P-9F4XCGA-CJ3H-QX75-8PJVCGA-J8HJ-389H-WH8VCGA-M569-CRFQ-9CPCCGA-V3CW-CH2J-C8G4
Timeline
- 23-04-2019PublishedVulnerability first disclosed.
- 02-10-2024Last modifiedVulnerability information updated.
Description
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS metrics
7 scores · 5 sources · 3 versionsMedium 5.9Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.9Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesSingle source
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
37.62%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 37.62% on 18-09-2026
18-09-202618-10-2026
EPSS score37.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard18 products
- openjdk-10All versions (No fix recorded)
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
Redhat9 products
- enterprise_linux8.0
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus8.2 | 8.4 | 8.6
Apache2 products
- cassandra≥ 2.1.0, < 2.1.22 | ≥ 2.2.0, < 2.2.18 | ≥ 3.0.0, < 3.0.22 | ≥ 3.11.0, < 3.11.8 | 4.0.0:beta1
- tomcat≥ 7.0.0, ≤ 7.0.97 | ≥ 8.5.0, ≤ 8.5.47 | ≥ 9.0.1, ≤ 9.0.28 | 9.0.0:milestone1 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone12 | 9.0.0:milestone13 | 9.0.0:milestone14 | 9.0.0:milestone15 | 9.0.0:milestone16 | 9.0.0:milestone17 | 9.0.0:milestone18 | 9.0.0:milestone19 | 9.0.0:milestone2 | 9.0.0:milestone20 | 9.0.0:milestone21 | 9.0.0:milestone22 | 9.0.0:milestone23 | 9.0.0:milestone24 | 9.0.0:milestone25 | 9.0.0:milestone26 | 9.0.0:milestone27 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9
Debian2 products
- openjdk-11< 11.0.3+7-1
- debian_linuxEOL8.0 | 9.0
Oracle2 products
Ubuntu2 products
- openjdk-8< 8u212-b03-0ubuntu1.16.04.1 | < 8u212-b03-0ubuntu1.18.04.1
- openjdk-lts< 11.0.3+7-1ubuntu2~18.04.1
Wolfi2 products
- openjdk-10All versions (No fix recorded)
- openjdk-9-jreAll versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10 | 19.04
Hp1 product
- xp7_command_view< 8.6.5-00
Opensuse1 product
- leapEOL15.0 | 42.3
Oracle corporation1 product
- javaJava SE: 7u211, 8u202, 11.0.2, 12 | Java SE Embedded: 8u201
11 vendors · 41 products
References
42 links- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCFIXPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.htmlVendor AdvisoryX Refsource SUSEAdvisoryThird Party Advisory
- access.redhat.com/errata/RHBA-2019:0959Vendor AdvisoryX Refsource REDHATAdvisoryMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/05/msg00011.htmlMailing ListX Refsource MLISTAdvisoryThird Party Advisory- access.redhat.com/errata/RHSA-2019:1146Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1164Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1163Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1165Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1166Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
Show all 42 references
- access.redhat.com/errata/RHSA-2019:1238Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.htmlVendor AdvisoryX Refsource SUSEAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.htmlVendor AdvisoryX Refsource SUSEAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.htmlVendor AdvisoryX Refsource SUSEAdvisoryMailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1325Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1518Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_usX Refsource CONFIRMAdvisoryThird Party Advisory
- support.f5.com/csp/article/K11175903?utm_source=f5support&%3Butm_medium=RSSX Refsource CONFIRMWEB
- www.openwall.com/lists/oss-security/2020/09/01/4Mailing ListX Refsource MLISTAdvisoryThird Party Advisory