MGASA-2019-0399

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2019-10086
Published: 19 Dec 2019, 13:44
Last modified:16 Apr 2026, 04:26

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Dec 2019, 13:44
Published
Vulnerability first disclosed
16 Apr 2026, 04:26
Last Modified
Vulnerability information updated

Description

Updated apache-commons-beanutils packages fix security vulnerability Updated apache-commons-beanutils packages fix security vulnerability: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean (CVE-2019-10086). Also, the apache-commons-collections package has been rebuilt to regenerate the OSGi metadata, to allow the apache-commons-beanutils package to build.

Affected Systems

  • mageia•apache-commons-beanutils

    < 1.9.4-1.mga7

  • mageia•apache-commons-collections

    < 3.2.2-7.1.mga7

References (3)