CVE-2019-17561 Improper Verification of Cryptographic Signature in Apache Netbeans
Attackers can execute arbitrary code by modifying downloaded NetBeans modules due to insufficient signature validation in the autoupdate system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17561?
CVE-2019-17561 is a high-severity code injection vulnerability in Oracle Graalvm, published on 30 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Weakness: CWE-347
Which versions are affected by CVE-2019-17561?
2 open source packages ship an affected version, including org.codehaus.mevenide:netbeans. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.codehaus.mevenide:netbeans Maven | All versions to 3.1.4 | None |
org.codehaus.mevenide:netbeans Maven | All versions to 3.1.4 | None |
Products include Apache Netbeans, Oracle Graalvm.
How do I fix CVE-2019-17561?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-17561 being exploited?
There is no known exploitation of CVE-2019-17561 in the wild and no public exploit code.
Other vulnerabilities in Oracle Graalvm
Sources
Also known as DEBIAN-CVE-2019-17561, GHSA-cf8q-j9h3-7237, UBUNTU-CVE-2019-17561.