Read the docs
TI-2019-07411 Aliases CVE-2019-10086GHSA-6phf-73q6-gh87

Deserialization of untrusted data in Apache Commons Beanutils

Priority MEDIUM 61CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 34 fixed, 18 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.29082 98th percentileScored 2026-11-07
Fix Partial commons-beanutils:commons-beanutils (Maven): 1.9.4Red Hat: 21 advisoriesRed Hat: 34 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Commons BeanutilsApache Commons Beanutils 1.0 to 1.9.3—No fix listedCNA
—commons-beanutils:commons-beanutils (Maven)before 1.9.41.9.4Patch availableGHSA-6phf-73q6-gh87
  • Apache Commons Beanutils VendorApache Affected Apache Commons Beanutils 1.0 to 1.9.3 Fixed in — No fix listed CNA
  • commons-beanutils:commons-beanutils (Maven) Vendor— Affected before 1.9.4 Fixed in 1.9.4 Patch available GHSA-6phf-73q6-gh87

CPE configurations NVD · 109

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:*1.0 – 1.9.3VulnerableApache
cpe:2.3:a:apache:nifi:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableApache
cpe:2.3:a:apache:nifi:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableApache
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
  • cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:* Versions 1.0 – 1.9.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:nifi:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:nifi:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
Show 99 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:e-business_suite:*:*3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:sap:*:*3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*3.6VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:sap:*:*3.6VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*7.5VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9:*:*:*:*:*:*:*11.3.0.9VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableOracle
cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*3.0.2.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:*7.3.4VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:*6.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:*6.3.1VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*7.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.3:*:*:*:*:*:*:*10.4.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*7.3.4VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.4.0.0:*:*:*:*:*:*:*13.4.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*2.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*2.8VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware:11.1.1.9:*:*:*:*:*:*:*11.1.1.9VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.1.5:*:*:*:*:*:*:*7.1.5VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:*7.2.2VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.3.1:*:*:*:*:*:*:*7.3.1VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableOracle
cpe:2.3:a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:*5.5VulnerableOracle
cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*5.6VulnerableOracle
cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_data_gateway:1.0.2.3:*:*:*:*:*:*:*1.0.2.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.5.3:*:*:*:*:*:*:*9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.5.3:*:*:*:*:*:*:*9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*16.2.0 – 16.2.11; 17.12.0 – 17.12.6VulnerableOracle
cpe:2.3:a:oracle:real-time_decisions_solutions:3.2.0.0:*:*:*:*:*:*:*3.2.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:5.0.3.1:*:*:*:*:*:*:*5.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_price_management:14.0:*:*:*:*:*:*:*14.0VulnerableOracle
cpe:2.3:a:oracle:retail_price_management:14.0.1:*:*:*:*:*:*:*14.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_price_management:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_price_management:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:solaris_cluster:4.4:*:*:*:*:*:*:*4.4VulnerableOracle
cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*12.2.6 – 12.2.11VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*4.3.0.1.0 – 4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*4.2.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*4.2.0.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*4.4.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*4.4.0.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*10.3.6.0.0VulnerableOracle
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:e-business_suite:*:* Versions 3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:sap:*:* Versions 3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:* Versions 3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:sap:*:* Versions 3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9:*:*:*:*:*:*:* Versions 11.3.0.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:* Versions 3.0.2.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:* Versions 6.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* Versions 7.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.3:*:*:*:*:*:*:* Versions 10.4.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware:11.1.1.9:*:*:*:*:*:*:* Versions 11.1.1.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.1.5:*:*:*:*:*:*:* Versions 7.1.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:* Versions 7.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_data_gateway:1.0.2.3:*:*:*:*:*:*:* Versions 1.0.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.5.3:*:*:*:*:*:*:* Versions 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.5.3:*:*:*:*:*:*:* Versions 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 16.2.0 – 16.2.11; 17.12.0 – 17.12.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real-time_decisions_solutions:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:5.0.3.1:*:*:*:*:*:*:* Versions 5.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_price_management:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_price_management:14.0.1:*:*:*:*:*:*:* Versions 14.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_price_management:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_price_management:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:solaris_cluster:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:* Versions 12.2.6 – 12.2.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1.0 – 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-6phf-73q6-gh87 commons-beanutils:commons-beanutils (Maven) Fixed in 1.9.4 Advisory →

Red Hat 21 advisories

  • RHSA-2025:9318 Released 2025-06-23 · Red Hat rating Important
    javapackages-tools:201801 security update
    • Red Hat Enterprise Linux CRB (v. 8) ant-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801, ant-1.10.5-1.module+el8.10.0+23274+27840b45.src::javapackages-tools:201801, ant-antlr-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801 +47
  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:3587 Released 2020-09-01 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R17 security and bug fix update
    • Red Hat Fuse 6.3
Show 18 more Red Hat advisories
  • RHSA-2020:3197 Released 2020-07-29 · Red Hat rating Important
    Red Hat Process Automation Manager 7.8.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
  • RHSA-2020:2740 Released 2020-06-24 · Red Hat rating Important
    candlepin and satellite security update
    • Red Hat Satellite 6.5 candlepin-2.5.22-1.el7sat, candlepin-selinux-2.5.22-1.el7sat, satellite-6.5.3.2-1.el7sat +4
    • Red Hat Satellite Capsule 6.5 satellite-6.5.3.2-1.el7sat, satellite-capsule-6.5.3.2-1.el7sat, satellite-common-6.5.3.2-1.el7sat +1
  • RHSA-2020:2619 Released 2020-06-19 · Red Hat rating Important
    Red Hat Fuse 7.6.0 on EAP security update
    • Red Hat Fuse 7.6.0 on EAP async
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview
  • RHSA-2020:2321 Released 2020-05-26 · Red Hat rating Important
    Red Hat Data Grid 7.3.6 security update
    • Red Hat Data Grid 7.3.6
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:1454 Released 2020-04-14 · Red Hat rating Important
    Satellite 6.7 release.
    • Red Hat Satellite 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
    • Red Hat Satellite Capsule 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
  • RHSA-2020:1308 Released 2020-04-02 · Red Hat rating Low
    Red Hat Virtualization Engine security, bug fix 4.3.9
    • RHV-M 4.3 ovirt-engine-4.3.9.3-0.1.el7, ovirt-engine-backend-4.3.9.3-0.1.el7, ovirt-engine-dbscripts-4.3.9.3-0.1.el7 +21
    • Tools for RHV Engine apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
  • RHSA-2020:0951 Released 2020-03-23 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.7 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2020:0899 Released 2020-03-18 · Red Hat rating Important
    Red Hat Decision Manager 7.7.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0805 Released 2020-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el7eap +47
  • RHSA-2020:0804 Released 2020-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el6eap +47
  • RHSA-2020:0806 Released 2020-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el8eap +47
  • RHSA-2020:0811 Released 2020-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.7 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:0194 Released 2020-01-21 · Red Hat rating Important
    apache-commons-beanutils security update
    • Red Hat Enterprise Linux Client Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
    • Red Hat Enterprise Linux Server Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7
  • RHSA-2020:0057 Released 2020-01-08 · Red Hat rating Important
    rh-java-common-apache-commons-beanutils security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-apache-commons-beanutils-1.8.3-14.14.el6, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.14.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-apache-commons-beanutils-1.8.3-14.15.el7, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-java-common-apache-commons-beanutils-1.8.3-14.15.el7, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-java-common-apache-commons-beanutils-1.8.3-14.15.el7, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-java-common-apache-commons-beanutils-1.8.3-14.15.el7, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-apache-commons-beanutils-1.8.3-14.14.el6, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.14.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-apache-commons-beanutils-1.8.3-14.15.el7, rh-java-common-apache-commons-beanutils-javadoc-1.8.3-14.15.el7
  • RHSA-2019:4317 Released 2019-12-18 · Red Hat rating Important
    rh-maven35-apache-commons-beanutils security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-apache-commons-beanutils-1.9.3-2.3.el7, rh-maven35-apache-commons-beanutils-javadoc-1.9.3-2.3.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
RHV-M 4.3Fixed RHSA-2020:1308
Red Hat Data Grid 7.3.6Fixed RHSA-2020:2321
Red Hat Decision Manager 7Fixed RHSA-2020:0899
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:9318
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:0194
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:0194
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:0194
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:0194
Red Hat Fuse 6.3Fixed RHSA-2020:3587
Red Hat Fuse 7.6.0 on EAP asyncFixed RHSA-2020:2619
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss EAP 7.2Fixed RHSA-2020:0811
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:0804
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:0805
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:0806
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat Process Automation 7Fixed RHSA-2020:3197
Red Hat Satellite 6.5Fixed RHSA-2020:2740
Red Hat Satellite 6.6Fixed—
Red Hat Satellite 6.7Fixed RHSA-2020:1454
Red Hat Satellite Capsule 6.5Fixed RHSA-2020:2740
Red Hat Satellite Capsule 6.6Fixed—
Red Hat Satellite Capsule 6.7Fixed RHSA-2020:1454
Red Hat Single Sign-On 7.3Fixed RHSA-2020:0951
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:4317, RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:4317, RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:4317, RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:4317, RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:0057
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:4317, RHSA-2020:0057
Text-Only RHOARFixed RHSA-2020:2067
Tools for RHV EngineFixed RHSA-2020:1308
Not affected: 3 products
  • RHV-M 4.3
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10086
  2. 2026-10-03 Alias added: GHSA-6phf-73q6-gh87
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 8

Advisory 13

Other 72

  • TI-2014-00108 Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache… CVSS 2.0HIGH 7.5
  • TI-2025-30956 Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences