CVE-2019-10086
Yüksek
Açıklama
Apache Commons Beanutils 1.9.2 sürümünde, bir saldırganın tüm Java nesnelerinde bulunan class özelliği aracılığıyla classloader'a erişim yeteneğini engellemeye olanak tanıyan özel bir BeanIntrospector sınıfı eklenmiştir. Ancak, PropertyUtilsBean'in bu varsayılan özelliğini kullanmıyorduk.
ÖnemYüksek
CVSS7.3
İstismar olasılığı—
Ürün
Apache Commons Beanutils
Yayın20 Ağu 2019
İlk görülme20 Ağu 2019
Nasıl düzeltilir
Güncelleyin
- oracle blockchain_platform21.1.2 ya da sonraki bir sürüm
- oracle jd_edwards_enterpriseone_orchestrator9.2.5.3 ya da sonraki bir sürüm
- oracle jd_edwards_enterpriseone_tools9.2.5.3 ya da sonraki bir sürüm
- commons-beanutils:commons-beanutils1.9.4 ya da sonraki bir sürüm
Üretici duyuruları
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
- access.redhat.com/errata/RHSA-2019:4317
- access.redhat.com/errata/RHSA-2020:0057
- access.redhat.com/errata/RHSA-2020:0194
- access.redhat.com/errata/RHSA-2020:0806
- access.redhat.com/errata/RHSA-2020:0811
- access.redhat.com/errata/RHSA-2020:0804
- access.redhat.com/errata/RHSA-2020:0805
Etkilenen ürünler
| Ürün | Etkilenen sürümler | Düzeltildiği sürüm |
|---|---|---|
| apache commons_beanutils | 1.0 ≤ v ≤ 1.9.3 | — |
| apache nifi | 1.14.0, 1.15.0 | — |
| debian debian_linux | 8.0 | — |
| opensuse leap | 15.0, 15.1 | — |
| fedoraproject fedora | 30, 31 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_eus | 7.7 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.7 | — |
| redhat enterprise_linux_server_tus | 7.7 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.5, 9.3.6 | — |
| oracle agile_product_lifecycle_management_integration_pack | 3.5, 3.6 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_platform | 2.4.0, 2.7.1, 2.9.0 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle communications_billing_and_revenue_management | 7.5, 12.0.0.3.0 | — |
| oracle communications_billing_and_revenue_management_elastic_charging_engine | 11.3.0.9, 12.0.0.3 | — |
| oracle communications_cloud_native_core_console | 1.4.0 | — |
| oracle communications_cloud_native_core_policy | 1.9.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.6.0 | — |
| oracle communications_convergence | 3.0.2.2.0 | — |
| oracle communications_design_studio | 7.3.4, 7.3.5, 7.4.0 | — |
| oracle communications_evolved_communications_application_server | 7.1 | — |
| oracle communications_metasolv_solution | 6.3.0, 6.3.1 | — |
| oracle communications_network_integrity | 7.3.6 | — |
| oracle communications_performance_intelligence_center | 10.4.0.3 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0 | — |
| oracle communications_unified_inventory_management | 7.3.4, 7.3.5, 7.4.0, 7.4.1 | — |
| oracle customer_management_and_segmentation_foundation | 18.0 | — |
| oracle enterprise_manager_for_virtualization | 13.4.0.0 | — |
| oracle financial_services_revenue_management_and_billing_analytics | 2.7, 2.8 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle fusion_middleware | 11.1.1.9, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle healthcare_foundation | 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1 | — |
| oracle hospitality_opera_5 | 5.5, 5.6 | — |
| oracle hospitality_reporting_and_analytics | 9.1.0 | — |
| oracle insurance_data_gateway | 1.0.2.3 | — |
| oracle jd_edwards_enterpriseone_orchestrator | v < 9.2.5.3, 9.2.5.3 | 9.2.5.3 |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.5.3, 9.2.5.3 | 9.2.5.3 |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57 | — |
| oracle peoplesoft_enterprise_pt_peopletools | 8.56, 8.57, 8.58 | — |
| oracle primavera_gateway | 16.2.0 ≤ v ≤ 16.2.11, 17.12.0 ≤ v ≤ 17.12.6 | — |
| oracle real-time_decisions_solutions | 3.2.0.0 | — |
| oracle retail_advanced_inventory_planning | 14.1 | — |
| oracle retail_back_office | 14.1 | — |
| oracle retail_central_office | 14.1 | — |
| oracle retail_invoice_matching | 16.0.3 | — |
| oracle retail_merchandising_system | 5.0.3.1 | — |
| oracle retail_point-of-service | 14.1 | — |
| oracle retail_predictive_application_server | 16.0 | — |
| oracle retail_price_management | 14.0, 14.0.1, 15.0, 16.0 | — |
| oracle retail_returns_management | 14.1 | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0, 18.0 | — |
| oracle service_bus | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle solaris_cluster | 4.4 | — |
| oracle time_and_labor | 12.2.6 ≤ v ≤ 12.2.11 | — |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | — |
| oracle weblogic_server | 10.3.6.0.0 | — |
| commons-beanutils:commons-beanutilsMaven | v < 1.9.4 | 1.9.4 |
Sürümünüzü kontrol edin
Ürünü seçin ve kullandığınız sürümü yazın; sürümün etkilenen aralıkta olup olmadığını görün.
Intelligence 360 paketinde
Attack Surface Management
Alan adlarınıza bağlı varlıkları, bu varlıklarda çalışan teknolojileri ve bilinen zafiyetleri tek listede görün.