https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Bug ID: 1767483 Summary: CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: bkearney@redhat.com, dblechte@redhat.com, decathorpe@gmail.com, dfediuck@redhat.com, eedri@redhat.com, fnasser@redhat.com, hhorak@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jorton@redhat.com, mgoldboi@redhat.com, mhroncok@redhat.com, michal.skrivanek@redhat.com, mizdebsk@redhat.com, omajid@redhat.com, qe-baseos-apps@redhat.com, sbonazzo@redhat.com, sgehwolf@redhat.com, sherold@redhat.com, SpikeFedora@gmail.com, stewardship-sig@lists.fedoraproject.org, tlestach@redhat.com, yturgema@redhat.com Target Milestone: --- Classification: Other
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Reference: http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798...
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1767498
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created apache-commons-beanutils tracking bugs for this issue:
Affects: fedora-all [bug 1767498]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1767498 [Bug 1767498] CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #2 from Fabio Valentini decathorpe@gmail.com --- The page for the CVE entry [0] claims that this affects versions <= 1.9.3, so 1.9.4 does not have this issue - do I understand this correctly?
If so, we can just merge the 1.9.4 update that's already in rawhide to stable fedora releases as well.
[0]: https://nvd.nist.gov/vuln/detail/CVE-2019-10086
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1767578
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Summer Long slong@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |apache-commons-beanutils | |1.9.4
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #3 from Summer Long slong@redhat.com --- External References:
http://http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RE...
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #4 from Summer Long slong@redhat.com --- External References:
https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-...
https://bugzilla.redhat.com/show_bug.cgi?id=1767483 Bug 1767483 depends on bug 1767498, which changed state.
Bug 1767498 Summary: CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1767498
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Summer Long slong@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Summer Long slong@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1772496, 1772495
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #6 from Paramvir jindal pjindal@redhat.com --- RHSSO 7.3.4 ships commons-beanutils-1.9.3.redhat-1.jar seems to be affected as per the description. This flaw allows attacker to manipulate the class loader properties on server and I am not sure which all properties are exposed by RHSSO so creating the tracker and leaving it to dev team to take it further.
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aboyko@redhat.com, | |dkreling@redhat.com
--- Comment #8 from Kunjan Rathod krathod@redhat.com --- This vulnerability is out of security support scope for the following products: * Red Hat Enterprise Application Platform 6 * Red Hat Enterprise Application Platform 5 * Red Hat JBoss Operations Network 3 * Red Hat JBoss BPMS 6 * Red Hat JBoss BRMS 6 * Red Hat JBoss SOA Platform 5
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #9 from Kunjan Rathod krathod@redhat.com --- In reply to comment #8:
This vulnerability is out of security support scope for the following products:
- Red Hat Enterprise Application Platform 6
- Red Hat Enterprise Application Platform 5
- Red Hat JBoss Operations Network 3
- Red Hat JBoss BPMS 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss SOA Platform 5
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1776318
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Stephen Kitt skitt@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |skitt@redhat.com Assignee|security-response-team@redh |skitt@redhat.com |at.com |
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Stephen Kitt skitt@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|skitt@redhat.com |security-response-team@redh | |at.com
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1777091
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1781295, 1781294
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1781716, 1781717, 1781714, | |1781715, 1781713
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #17 from Paramvir jindal pjindal@redhat.com --- Both RHDM 7.5.1 and RHPAM 7.5.1 ships commons-beanutils-1.9.3.redhat-1.jar which seems to be affected so marking them as affected and creating trackers for them :
./standalone/deployments/decision-central.war/WEB-INF/lib/commons-beanutils-1.9.3.redhat-1.jar ./standalone/deployments/business-central.war/WEB-INF/lib/commons-beanutils-1.9.3.redhat-1.jar
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1782344
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1782461, 1782459, 1782462, | |1782460
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(krathod@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
Via RHSA-2019:4317 https://access.redhat.com/errata/RHSA-2019:4317
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:4317
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-12-18 20:09:25
--- Comment #25 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-10086
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |cbuissar@redhat.com Flags|needinfo?(krathod@redhat.co |needinfo?(cbuissar@redhat.c |m) |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(cbuissar@redhat.c | |om) |
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
Via RHSA-2020:0057 https://access.redhat.com/errata/RHSA-2020:0057
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0057
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:0194 https://access.redhat.com/errata/RHSA-2020:0194
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0194
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1809371, 1809370
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2020:0811 https://access.redhat.com/errata/RHSA-2020:0811
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0811
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #35 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
Via RHSA-2020:0806 https://access.redhat.com/errata/RHSA-2020:0806
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0806
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #36 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
Via RHSA-2020:0804 https://access.redhat.com/errata/RHSA-2020:0804
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0804
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #37 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
Via RHSA-2020:0805 https://access.redhat.com/errata/RHSA-2020:0805
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0805
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #39 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2020:0899 https://access.redhat.com/errata/RHSA-2020:0899
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0899
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Doc Text *updated* by Kunjan Rathod krathod@redhat.com --- A flaw was found in Apache Commons Beanutils where the class property in PropertyUtilsBean is not suppressed by default which may lead to the ability of an attacker to access the classloader.
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader.
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #40 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On
Via RHSA-2020:0951 https://access.redhat.com/errata/RHSA-2020:0951
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0951
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #41 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Virtualization Engine 4.3 Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
Via RHSA-2020:1308 https://access.redhat.com/errata/RHSA-2020:1308
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:1308
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #42 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Satellite 6.7 for RHEL 7
Via RHSA-2020:1454 https://access.redhat.com/errata/RHSA-2020:1454
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:1454
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #43 from Chess Hazlett chazlett@redhat.com --- Mitigation:
There is no currently known mitigation for this flaw.
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #44 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes
Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2067
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #45 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 7.3.6
Via RHSA-2020:2321 https://access.redhat.com/errata/RHSA-2020:2321
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2321
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #46 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP-CD 19 Tech Preview
Via RHSA-2020:2333 https://access.redhat.com/errata/RHSA-2020:2333
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2333
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #48 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.6.0 on EAP async
Via RHSA-2020:2619 https://access.redhat.com/errata/RHSA-2020:2619
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2619
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #49 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Satellite 6.5 for RHEL 7
Via RHSA-2020:2740 https://access.redhat.com/errata/RHSA-2020:2740
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2740
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #50 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.7.0
Via RHSA-2020:3192 https://access.redhat.com/errata/RHSA-2020:3192
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3192
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #51 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #53 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Virtualization Engine 4.4
Via RHSA-2020:3247 https://access.redhat.com/errata/RHSA-2020:3247
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3247
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #54 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 6.3
Via RHSA-2020:3587 https://access.redhat.com/errata/RHSA-2020:3587
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3587
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Joshua Mulliken jmullike@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2014197
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
--- Comment #58 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:5856
java-sig-commits@lists.fedoraproject.org