Not rated

CVE-2019-17560 The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads

Description

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Affected products and versions

Product	Affected versions	Fixed in
Apache NetBeans	Versions not published

The 3 CVEs of Apache NetBeans →

CVE-2020-11986 To be able to analyze gradle projects, the build scripts need to be executed Not rated CVE-2019-17561 The "Apache NetBeans" autoupdate system does not fully validate code signatures Not rated

Do you use Apache NetBeans?

Track this CVE Watch Apache NetBeans Check my SBOMs

www.cveye.io/en/cve/CVE-2019-17560

Timeline

Published March 30, 2020
Last modified August 5, 2024

References

www.oracle.com www.oracle.com
lists.apache.org lists.apache.org

Track this CVE

CVE-2019-17560 The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads

Description

Affected products and versions

Other CVEs of Apache NetBeans