Debian Long Term Support / LTS Security Information / 2019 / Security Information -- DLA-1896-1 commons-beanutils

Debian Security Advisory

DLA-1896-1 commons-beanutils -- LTS security update

Date Reported:

24 Aug 2019

Affected Packages:

commons-beanutils

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2019-10086.

More information:

It was discovered that there was a remote arbitrary code vulnerability in commons-beanutils, a set of utilities for manipulating JavaBeans code.

• CVE-2019-10086

  In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

For Debian 8 Jessie, these problems have been fixed in version 1.9.2-1+deb8u1.

We recommend that you upgrade your commons-beanutils packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS