GitHub Advisoryadvisory · Maven

GHSA-cf8q-j9h3-7237 Improper Verification of Cryptographic Signature in Apache Netbeans

HIGH Published 2022-05-24 Modified 2022-11-14 Official page ↗
Aliases
CVE-2019-17561
Ecosystem
Maven
Packages
org.codehaus.mevenide:netbeans
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-347
Reviewed
2022-11-14

Affected packages

• Maven org.codehaus.mevenide:netbeans: <= 3.1.4 (no fix yet)

Description

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.

Related

Alias · CVE (1)

  • CVE-2019-17561 The "Apache NetBeans" autoupdate system does not fully validate code signatures. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References