CVE-2019-17560: Critical severity oracle netbeans vulnerability
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17560?
The severity of CVE-2019-17560 is considered high due to the potential for attackers to inject malicious code.
How do I fix CVE-2019-17560?
To fix CVE-2019-17560, users should upgrade Apache NetBeans to version 11.3 or later which includes the necessary SSL certificate validation.
What versions are affected by CVE-2019-17560?
CVE-2019-17560 affects Apache NetBeans versions up to and including 11.2.
Can CVE-2019-17560 be exploited remotely?
Yes, CVE-2019-17560 can be exploited remotely as it allows interception of downloads during the autoupdate process.
What software is impacted by CVE-2019-17560?
CVE-2019-17560 impacts Apache NetBeans and specific versions of Oracle GraalVM Enterprise Edition.