Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache NetBeans allows tampered updates to be installed

CVE-2019-17561 · published 6 years ago
Summary

Apache NetBeans users may inadvertently install malicious code updates. This is a concern because an attacker could sneak in malicious code alongside legitimate updates. To protect your system, update to a fixed version of Apache NetBeans or disable autoupdate functionality until a patch is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven codehaus org.codehaus.mevenide:netbeans <= 3.1.4
– apache netbeans <= 11.2
cpe:2.3:a:apache:netbeans:*:*:*:*:*:*:*:*
– oracle graalvm 19.3.2
20.1.0
cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*
Ubuntu:16.04:LTS canonical netbeans All versions
Original advisory text
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and includ...
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published30 Mar 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-cf8q-j9h3-7237 · GHSA
CVE-2019-17561 · NVD
UBUNTU-CVE-2019-17561 · OSV
CVE-2019-17561 · OSV
Track software like this
Free during beta