GitHub Advisoryadvisory · Maven

GHSA-7c2m-vwxw-5qww Improper Certificate Validation in Apache Netbeans

CRITICAL Published 2022-05-24 Modified 2023-02-15 Official page ↗
Aliases
CVE-2019-17560
Ecosystem
Maven
Packages
org.codehaus.mevenide:netbeans
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2022-11-14

Affected packages

• Maven org.codehaus.mevenide:netbeans: <= 3.1.4 (no fix yet)

Description

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.

Related

Alias · CVE (1)

  • CVE-2019-17560 The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References