CVE-2019-10086
High
Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
SeverityHigh
CVSS7.3
Exploit probability—
Product
Apache Commons Beanutils
PublishedAug 20, 2019
First seenAug 20, 2019
How to fix
Update
- oracle blockchain_platform21.1.2 or later
- oracle jd_edwards_enterpriseone_orchestrator9.2.5.3 or later
- oracle jd_edwards_enterpriseone_tools9.2.5.3 or later
- commons-beanutils:commons-beanutils1.9.4 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
- access.redhat.com/errata/RHSA-2019:4317
- access.redhat.com/errata/RHSA-2020:0057
- access.redhat.com/errata/RHSA-2020:0194
- access.redhat.com/errata/RHSA-2020:0806
- access.redhat.com/errata/RHSA-2020:0811
- access.redhat.com/errata/RHSA-2020:0804
- access.redhat.com/errata/RHSA-2020:0805
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache commons_beanutils | 1.0 ≤ v ≤ 1.9.3 | — |
| apache nifi | 1.14.0, 1.15.0 | — |
| debian debian_linux | 8.0 | — |
| opensuse leap | 15.0, 15.1 | — |
| fedoraproject fedora | 30, 31 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_eus | 7.7 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.7 | — |
| redhat enterprise_linux_server_tus | 7.7 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.5, 9.3.6 | — |
| oracle agile_product_lifecycle_management_integration_pack | 3.5, 3.6 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_platform | 2.4.0, 2.7.1, 2.9.0 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle communications_billing_and_revenue_management | 7.5, 12.0.0.3.0 | — |
| oracle communications_billing_and_revenue_management_elastic_charging_engine | 11.3.0.9, 12.0.0.3 | — |
| oracle communications_cloud_native_core_console | 1.4.0 | — |
| oracle communications_cloud_native_core_policy | 1.9.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.6.0 | — |
| oracle communications_convergence | 3.0.2.2.0 | — |
| oracle communications_design_studio | 7.3.4, 7.3.5, 7.4.0 | — |
| oracle communications_evolved_communications_application_server | 7.1 | — |
| oracle communications_metasolv_solution | 6.3.0, 6.3.1 | — |
| oracle communications_network_integrity | 7.3.6 | — |
| oracle communications_performance_intelligence_center | 10.4.0.3 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0 | — |
| oracle communications_unified_inventory_management | 7.3.4, 7.3.5, 7.4.0, 7.4.1 | — |
| oracle customer_management_and_segmentation_foundation | 18.0 | — |
| oracle enterprise_manager_for_virtualization | 13.4.0.0 | — |
| oracle financial_services_revenue_management_and_billing_analytics | 2.7, 2.8 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle fusion_middleware | 11.1.1.9, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle healthcare_foundation | 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1 | — |
| oracle hospitality_opera_5 | 5.5, 5.6 | — |
| oracle hospitality_reporting_and_analytics | 9.1.0 | — |
| oracle insurance_data_gateway | 1.0.2.3 | — |
| oracle jd_edwards_enterpriseone_orchestrator | v < 9.2.5.3, 9.2.5.3 | 9.2.5.3 |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.5.3, 9.2.5.3 | 9.2.5.3 |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57 | — |
| oracle peoplesoft_enterprise_pt_peopletools | 8.56, 8.57, 8.58 | — |
| oracle primavera_gateway | 16.2.0 ≤ v ≤ 16.2.11, 17.12.0 ≤ v ≤ 17.12.6 | — |
| oracle real-time_decisions_solutions | 3.2.0.0 | — |
| oracle retail_advanced_inventory_planning | 14.1 | — |
| oracle retail_back_office | 14.1 | — |
| oracle retail_central_office | 14.1 | — |
| oracle retail_invoice_matching | 16.0.3 | — |
| oracle retail_merchandising_system | 5.0.3.1 | — |
| oracle retail_point-of-service | 14.1 | — |
| oracle retail_predictive_application_server | 16.0 | — |
| oracle retail_price_management | 14.0, 14.0.1, 15.0, 16.0 | — |
| oracle retail_returns_management | 14.1 | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0, 18.0 | — |
| oracle service_bus | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle solaris_cluster | 4.4 | — |
| oracle time_and_labor | 12.2.6 ≤ v ≤ 12.2.11 | — |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | — |
| oracle weblogic_server | 10.3.6.0.0 | — |
| commons-beanutils:commons-beanutilsMaven | v < 1.9.4 | 1.9.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.