Insecure Deserialization in Apache Commons Beanutils

HIGH 7.3CVE-2019-10086 · GHSA-6phf-73q6-gh87 · Published 20/08/2019 · updated 08/10/2026

Package	Affected versions	Patched versions
commons-beanutils:commons-beanutils Maven	`< 1.9.4`	`1.9.4`
commons beanutils apache	`≥ 1.0, ≤ 1.9.3`	No fix yet
nifi apache	`= 1.14.0= 1.15.0`	No fix yet
agile product lifecycle management oracle	`= 9.3.3= 9.3.5= 9.3.6`	No fix yet
agile product lifecycle management integration pack oracle	`= 3.5= 3.6`	No fix yet
application testing suite oracle	`= 13.3.0.1`	No fix yet
banking platform oracle	`= 2.4.0= 2.7.1= 2.9.0`	No fix yet
blockchain platform oracle	`< 21.1.2`	`21.1.2`
communications billing and revenue management oracle	`= 12.0.0.3.0= 7.5`	No fix yet
communications billing and revenue management elastic charging engine oracle	`= 11.3.0.9= 12.0.0.3`	No fix yet
communications cloud native core console oracle	`= 1.4.0`	No fix yet
communications cloud native core policy oracle	`= 1.9.0`	No fix yet
communications cloud native core unified data repository oracle	`= 1.6.0`	No fix yet
communications convergence oracle	`= 3.0.2.2.0`	No fix yet
communications design studio oracle	`= 7.3.4= 7.3.5= 7.4.0`	No fix yet
communications evolved communications application server oracle	`= 7.1`	No fix yet
communications metasolv solution oracle	`= 6.3.0= 6.3.1`	No fix yet
communications network integrity oracle	`= 7.3.6`	No fix yet
communications performance intelligence center oracle	`= 10.4.0.3`	No fix yet
communications pricing design center oracle	`= 12.0.0.3.0`	No fix yet
communications unified inventory management oracle	`= 7.3.4= 7.3.5= 7.4.0= 7.4.1`	No fix yet
customer management and segmentation foundation oracle	`= 18.0`	No fix yet
enterprise manager for virtualization oracle	`= 13.4.0.0`	No fix yet
financial services revenue management and billing analytics oracle	`= 2.7= 2.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
fusion middleware oracle	`= 11.1.1.9= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
healthcare foundation oracle	`= 7.1.5= 7.2.2= 7.3.0= 7.3.1= 8.0.1`	No fix yet
hospitality opera 5 oracle	`= 5.5= 5.6`	No fix yet
hospitality reporting and analytics oracle	`= 9.1.0`	No fix yet
insurance data gateway oracle	`= 1.0.2.3`	No fix yet
jd edwards enterpriseone orchestrator oracle	`= 9.2.5.3< 9.2.5.3`	`9.2.5.3`
jd edwards enterpriseone tools oracle	`= 9.2.5.3< 9.2.5.3`	`9.2.5.3`
peoplesoft enterprise peopletools oracle	`= 8.56= 8.57`	No fix yet
peoplesoft enterprise pt peopletools oracle	`= 8.56= 8.57= 8.58`	No fix yet
primavera gateway oracle	`≥ 16.2.0, ≤ 16.2.11≥ 17.12.0, ≤ 17.12.6`	No fix yet
real-time decisions solutions oracle	`= 3.2.0.0`	No fix yet
retail advanced inventory planning oracle	`= 14.1`	No fix yet
retail back office oracle	`= 14.1`	No fix yet
retail central office oracle	`= 14.1`	No fix yet
retail invoice matching oracle	`= 16.0.3`	No fix yet
retail merchandising system oracle	`= 5.0.3.1`	No fix yet
retail point-of-service oracle	`= 14.1`	No fix yet
retail predictive application server oracle	`= 16.0`	No fix yet
retail price management oracle	`= 14.0= 14.0.1= 15.0= 16.0`	No fix yet
retail returns management oracle	`= 14.1`	No fix yet
retail xstore point of service oracle	`= 15.0= 16.0= 17.0= 18.0= 7.1`	No fix yet
service bus oracle	`= 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
solaris cluster oracle	`= 4.4`	No fix yet
time and labor oracle	`≥ 12.2.6, ≤ 12.2.11`	No fix yet
utilities framework oracle	`= 4.2.0.2.0= 4.2.0.3.0= 4.4.0.0.0= 4.4.0.2.0= 4.4.0.3.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0`	No fix yet
weblogic server oracle	`= 10.3.6.0.0`	No fix yet
jboss enterprise application platform redhat	`= 7.2.0`	No fix yet

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

NVD description

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free