CVE-2019-10086 in the critical feed json
Insecure Deserialization in Apache Commons Beanutils
published 2019-08-20 7 y ago modified 2026-10-08 31 d ago also GHSA-6phf-73q6-gh87 , EUVD-2020-0465
- cvss
- 7.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 29.1%
- EPSS 29.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Patch / fix
- maven commons-beanutils:commons-beanutils 1.9.4
- oracle blockchain_platform 21.1.2
- oracle jd_edwards_enterpriseone_orchestrator 9.2.5.3
- oracle jd_edwards_enterpriseone_tools 9.2.5.3
- commons-beanutils Debian 14, Debian 13, Debian 12 1.9.4-1
debian advisories DEBIAN-CVE-2019-10086
- commons-beanutils Ubuntu Pro 14.04 LTS 1.9.1-1ubuntu0.1~esm1
- commons-beanutils Ubuntu Pro 16.04 LTS 1.9.2-3ubuntu0.1~esm1
- commons-beanutils Ubuntu Pro 18.04 LTS 1.9.3-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2019-10086
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ant RHEL 8 1.10.5-1.module+el8.10.0+23274+27840b45
- bsf RHEL 8 2.4.0-30.module+el8.10.0+23274+27840b45
- bsh RHEL 8 2.0-13.b6.module+el8.10.0+23274+27840b45
- bcel RHEL 8 6.2-2.module+el8.10.0+23274+27840b45
- jdom RHEL 8 1.1.3-17.module+el8.10.0+23274+27840b45
- jsch RHEL 8 0.1.54-6.module+el8.10.0+23274+27840b45
- qdox RHEL 8 2.0-3.M9.module+el8.10.0+23274+27840b45
- sisu RHEL 8 1:0.3.3-7.module+el8.10.0+23274+27840b45
red hat advisories RHSA-2025:9318RHSA-2024:5856RHSA-2020:0806RHSA-2020:0805RHSA-2020:0804RHSA-2020:2740
- apache-commons-beanutils SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15 1.9.2-4.3.1
- apache-commons-beanutils SLES for SAP 12 SP4, SLES 12 SP4 1.9.2-3.3.1
suse advisories SUSE-SU-2019:2245-1SUSE-SU-2019:2244-1
- apache-commons-beanutils openSUSE Tumbleweed 1.9.4-3.7
- apache-commons-beanutils openSUSE Leap 15.1, openSUSE Leap 15.0 1.9.2-lp151.3.3.1
opensuse advisories openSUSE-SU-2024:10617-1openSUSE-SU-2019:2058-1
- ant AlmaLinux 8 1.10.5-1.module_el8.0.0+6004+2fc32706
- bsf AlmaLinux 8 2.4.0-30.module_el8.0.0+6004+2fc32706
- bsh AlmaLinux 8 2.0-13.b6.module_el8.0.0+6004+2fc32706
- bcel AlmaLinux 8 6.2-2.module_el8.0.0+6004+2fc32706
- jdom AlmaLinux 8 1.1.3-17.module_el8.0.0+6004+2fc32706
- jsch AlmaLinux 8 0.1.54-6.module_el8.0.0+6004+2fc32706
- qdox AlmaLinux 8 2.0-3.M9.module_el8.0.0+6004+2fc32706
- xmvn AlmaLinux 8 3.0.0-21.module_el8.0.0+6004+2fc32706
almalinux advisories ALSA-2025:9318
- ant Rocky Linux 8 1.10.5-1.module+el8.3.0+74+855e3f5d
- ant Rocky Linux 8 1.10.5-1.module+el8.10.0+2003+8aeac9cb
- bsf Rocky Linux 8 2.4.0-30.module+el8.3.0+74+855e3f5d
- bsh Rocky Linux 8 2.0-13.b6.module+el8.3.0+74+855e3f5d
- bcel Rocky Linux 8 6.2-2.module+el8.3.0+74+855e3f5d
- jdom Rocky Linux 8 1.1.3-17.module+el8.3.0+74+855e3f5d
- jsch Rocky Linux 8 0.1.54-6.module+el8.3.0+74+855e3f5d
- qdox Rocky Linux 8 2.0-3.M9.module+el8.3.0+74+855e3f5d
rocky linux advisories RLSA-2025:9318
- oracle.com/security-alerts/cpuapr2020.html advisory
- oracle.com/security-alerts/cpujul2020.html advisory
- oracle.com/security-alerts/cpujan2021.html advisory
- oracle.com//security-alerts/cpujul2021.html advisory
- oracle.com/security-alerts/cpuApr2021.html advisory
- oracle.com/security-alerts/cpuapr2022.html advisory
- oracle.com/security-alerts/cpujan2022.html advisory
- oracle.com/security-alerts/cpuoct2021.html advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-10086 updated cvss 7.3
apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
-
Red Hat AMQ Broker 7 commons-beanutilsaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat BPM Suite 6 commons-beanutils Red Hat Enterprise Linux 5 jakarta-commons-beanutils Red Hat Enterprise Linux 6 jakarta-commons-beanutils, jakarta-commons-beanutils-javadocaffected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
-
Red Hat JBoss A-MQ 6 commons-beanutilsaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat JBoss BRMS 5 commons-beanutils Red Hat JBoss Data Virtualization 6 commons-binutils commons-binutils Red Hat JBoss Enterprise Application Platform 5 commons-beanutils Red Hat JBoss Enterprise Application Platform 6 commons-beanutils Red Hat JBoss Fuse Service Works 6 commons-beanutils Red Hat JBoss Operations Network 3 commons-beanutilsaffected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
+2 more productsfewer
Red Hat JBoss SOA Platform 5 commons-beanutils Red Hat Mobile Application Platform 4 commons-beanutils -
Red Hat OpenShift Application Runtimes commons-beanutilsaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat OpenStack Platform 10 (Newton) opendaylightaffected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
-
Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat OpenStack Platform 14 (Rocky) opendaylightaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat Satellite 5 apache-commons-beanutilsaffected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
show 20 moreshow fewer
-
Red Hat EAP-CD 19 Tech Previewfixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2333
-
Red Hat Data Grid 7.3.6fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2321
-
Red Hat Decision Manager 7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0899
-
Red Hat Enterprise Linux Client Optional (v. 7) apache-commons-beanutils 1.8.3-15.el7_7, apache-commons-beanutils-javadoc 1.8.3-15.el7_7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) apache-commons-beanutils 1.8.3-15.el7_7, apache-commons-beanutils-javadoc 1.8.3-15.el7_7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0194
-
Red Hat Enterprise Linux CRB (v. 8) bcel 6.2-2.module+el8.10.0+23274+27840b45, xbean 4.8-1.module+el8.10.0+23274+27840b45, ant 1.10.5-1.module+el8.10.0+23274+27840b45, bsf 2.4.0-30.module+el8.10.0+23274+27840b45, junit 4.12-9.module+el8.10.0+23274+27840b45, sisu 0.3.3-7.module+el8.10.0+23274+27840b45, +507 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2025:9318
-
Red Hat Enterprise Linux Server Optional (v. 7) apache-commons-beanutils 1.8.3-15.el7_7, apache-commons-beanutils-javadoc 1.8.3-15.el7_7 Red Hat Enterprise Linux Workstation Optional (v. 7) apache-commons-beanutils 1.8.3-15.el7_7, apache-commons-beanutils-javadoc 1.8.3-15.el7_7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0194
-
Red Hat Fuse 6.3fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3587
-
Red Hat Fuse 7.6.0 on EAP asyncfixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2619
-
Red Hat Fuse 7.7.0fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3192
-
Red Hat JBoss EAP 7.2fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0811
-
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-thrift 0.13.0-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el6eap, +98 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0804
-
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-thrift 0.13.0-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el7eap, +100 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0805
-
Red Hat JBoss EAP 7.2 for RHEL 8 eap7-thrift 0.13.0-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-stax2-api 4.2.0-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.7-4.GA_redhat_00004.1.el8eap, +98 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:0806
-
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils 1.9.4-1.redhat_00002.1.ep7.el7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2024:5856
-
Red Hat Process Automation 7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3197
-
Red Hat Satellite 6.5 candlepin 2.5.22-1.el7sat, satellite 6.5.3.2-1.el7sat, satellite-cli 6.5.3.2-1.el7sat, candlepin-selinux 2.5.22-1.el7sat, satellite-common 6.5.3.2-1.el7sat, satellite-capsule 6.5.3.2-1.el7sat, +1 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2740
-
Red Hat Satellite 6.6 katello 3.12.0-3.el7sat, satellite 6.6.2-1.el7sat, candlepin 2.6.13-1.el7sat, foreman 1.22.0.36-1.el7sat, satellite-cli 6.6.2-1.el7sat, foreman-cli 1.22.0.36-1.el7sat, +23 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHBA-2020:0496
-
Red Hat Satellite 6.7 tfm 5.0-9.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.0-1.el7sat, gofer 2.12.5-7.el7sat, receptor 0.6.1-1.el7ar, tfm-ror52 1.0-4.el7sat, +498 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:1454
-
Red Hat Satellite Capsule 6.5 satellite 6.5.3.2-1.el7sat, satellite-common 6.5.3.2-1.el7sat, satellite-capsule 6.5.3.2-1.el7sat, satellite-debug-tools 6.5.3.2-1.el7satfixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2740
-
Red Hat Satellite Capsule 6.6 katello 3.12.0-3.el7sat, satellite 6.6.2-1.el7sat, foreman 1.22.0.36-1.el7sat, katello-common 3.12.0-3.el7sat, katello-service 3.12.0-3.el7sat, satellite-common 6.6.2-1.el7sat, +6 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHBA-2020:0496
12 more fixed, 3 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
29.08% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | commons-beanutils:commons-beanutils | <1.9.4 |
1.9.4 |
Affected products
- Apache Apache Commons Beanutils
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
oracle.com
/security-alerts/cpuapr2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujul2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2021.html
web, patch, third-party-advisory
-
oracle.com
//security-alerts/cpujul2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuApr2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-09/msg00007.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4317
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0057
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0194
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0806
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0811
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0804
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0805
vendor-advisory, web, third-party-advisory
-
mail-archives.apache.org
/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e
mailing-list
-
lists.debian.org
/debian-lts-announce/2019/08/msg00030.html
mailing-list, web
-
lists.apache.org
/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpujan2020.html
web
-
lists.apache.org
/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.or
mailing-list
-
lists.apache.org
/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.or
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2019-10086
advisory
-
lists.apache.org
/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E
web
-
lists.apache.org
/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%
web
-
lists.apache.org
/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E
web
-
lists.apache.org
/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E
web
-
lists.apache.org
/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E
web
-
lists.apache.org
/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E
web
-
lists.apache.org
/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF
web
Sources
- CVE List CVE-2019-10086
- GitHub Advisory GHSA-6phf-73q6-gh87
- NVD CVE-2019-10086
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.