Red Hat Security Advisory

RHSA-2019:4317

rh-maven35-apache-commons-beanutils security update

Released 2019-12-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7

Fixes 1 record

TI-2019-07411 CVE-2019-10086 · GHSA-6phf-73q6-gh87

Deserialization of untrusted data in Apache Commons Beanutils

MEDIUM 61

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.29082 Published 2019-08-20 Partial fix · 1.9.4 CWE-502