Improper Certificate Validation in Apache Netbeans
Date: 2022-05
Affected: maven/org.codehaus.mevenide:netbeans
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2019-17560
CVE-2019-17561
CWE: CWE-20
CWE-295
CWE-347
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.


Mitigations:

Architectural layers (MAESTRO):