Red Hat Security AdvisoryRHSA-2020:0194
apache-commons-beanutils security update
Released 2020-01-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
Fixes 1 record
Priority MEDIUM 61
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.29082 · Published 2019-08-20 · Partial fix · 1.9.4 CWE-502
