CVE-2019-10086 Insecure Deserialization in Apache Commons Beanutils
Attackers can exploit unsafe deserialization in Apache Commons Beanutils to execute arbitrary code by accessing the classloader via the class property.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10086?
CVE-2019-10086 is a high-severity unsafe deserialization vulnerability in Apache Nifi, published on 20 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Weakness: CWE-502
Which versions are affected by CVE-2019-10086?
2 open source packages ship an affected version, including commons-beanutils:commons-beanutils. It affects 60 products.
| Package | Affected | Fixed in |
|---|---|---|
commons-beanutils:commons-beanutils Maven | All versions | 1.9.4 |
commons-beanutils:commons-beanutils Maven | All versions | 1.9.4 |
Linux distribution packages (38)
apache-commons-beanutils Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.3-15.el7_7 |
apache-commons-beanutils-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.3-15.el7_7 |
rh-java-common-apache-commons-beanutils Red Hat:rhel_software_collections:3::el6 | All versions | 0:1.8.3-14.14.el6 |
rh-java-common-apache-commons-beanutils-javadoc Red Hat:rhel_software_collections:3::el6 | All versions | 0:1.8.3-14.14.el6 |
rh-java-common-apache-commons-beanutils Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.8.3-14.15.el7 |
rh-java-common-apache-commons-beanutils-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.8.3-14.15.el7 |
rh-maven35-apache-commons-beanutils Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.9.3-2.3.el7 |
rh-maven35-apache-commons-beanutils-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.9.3-2.3.el7 |
candlepin Red Hat:satellite:6.5::el7 | All versions | 0:2.5.22-1.el7sat |
candlepin-selinux Red Hat:satellite:6.5::el7 | All versions | 0:2.5.22-1.el7sat |
satellite Red Hat:satellite:6.5::el7 | All versions | 0:6.5.3.2-1.el7sat |
satellite-capsule Red Hat:satellite:6.5::el7 | All versions | 0:6.5.3.2-1.el7sat |
satellite-cli Red Hat:satellite:6.5::el7 | All versions | 0:6.5.3.2-1.el7sat |
satellite-common Red Hat:satellite:6.5::el7 | All versions | 0:6.5.3.2-1.el7sat |
satellite-debug-tools Red Hat:satellite:6.5::el7 | All versions | 0:6.5.3.2-1.el7sat |
candlepin Red Hat:satellite:6.6::el7 | All versions | 0:2.6.13-1.el7sat |
candlepin-selinux Red Hat:satellite:6.6::el7 | All versions | 0:2.6.13-1.el7sat |
foreman Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-cli Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-debug Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-ec2 Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-gce Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-installer Red Hat:satellite:6.6::el7 | All versions | 1:1.22.0.17-1.el7sat |
foreman-installer-katello Red Hat:satellite:6.6::el7 | All versions | 1:1.22.0.17-1.el7sat |
foreman-journald Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-libvirt Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-openstack Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-ovirt Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-postgresql Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-proxy-content Red Hat:satellite:6.6::el7 | All versions | 0:3.12.0-3.el7sat |
foreman-rackspace Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
foreman-telemetry Red Hat:satellite:6.6::el7 | All versions | 0:1.22.0.36-1.el7sat |
Products include Apache Commons Beanutils, Apache Nifi, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Oracle Agile Product Lifecycle Management and 54 more.
How do I fix CVE-2019-10086?
Upgrade commons-beanutils:commons-beanutils to 1.9.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-10086 being exploited?
There is no known exploitation of CVE-2019-10086 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
Sources
Also known as CLSA-2026-1777336746, DEBIAN-CVE-2019-10086, DLA-1896-1, ECHO-97f7-6f4b-017b, GHSA-6phf-73q6-gh87, MGASA-2019-0399 and 10 more.