CVE-2019-17561

Improper Verification of Cryptographic Signature in Apache Netbeans

7.5 HighFix available

CVE-2019-17561 is a high vulnerability (CVSS 7.5) in Apache Netbeans, published March 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 76th percentile. Fixed in netbeans 12.1-1.

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

1.68%Down 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2019-17561
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-347
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-17561
Updated: 2026-11-02

EUVDEUVD-2022-3568 No score

Record: EUVD-2022-3568
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cf8q-j9h3-7237 7.5

Improper Verification of Cryptographic Signature in Apache Netbeans

Record: GHSA-cf8q-j9h3-7237
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20, CWE-347
Updated: 2026-11-02

OSV 7.5

Record: CVE-2019-17561
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-17561 7.5

Record: DEBIAN-CVE-2019-17561
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-cf8q-j9h3-7237 7.5

Improper Verification of Cryptographic Signature in Apache Netbeans

Record: GHSA-cf8q-j9h3-7237
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20, CWE-347
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-17561 7.5

Record: UBUNTU-CVE-2019-17561
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.codehaus.mevenide:netbeans` Maven	through 3.1.4	None known
`netbeans` Debian:12	before 12.1-1	12.1-1
`netbeans` Debian:13	before 12.1-1	12.1-1
`netbeans` Debian:14	before 12.1-1	12.1-1
`org.codehaus.mevenide:netbeans` Maven	through 3.1.4, plus listed versions 1.21.31.43.0.103.0.123.0.93.1.1	None known
`netbeans` Ubuntu:16.04:LTS	All versions, plus listed versions 8.0.2+dfsg1-48.0.2+dfsg1-58.1+dfsg1-18.1+dfsg2-18.1+dfsg2-3	None known
`netbeans` Ubuntu:18.04:LTS	All versions, plus listed versions 8.1+dfsg3-410.0-3~18.04.1ubuntu110.0-3ubuntu2~18.04.1	None known
`netbeans` Ubuntu:20.04:LTS	All versions, plus listed versions 10.0-3ubuntu3	None known
`netbeans` Ubuntu:22.04:LTS	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:24.04:LTS	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:25.10	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:26.10	All versions, plus listed versions 12.1-3build1	None known
`netbeans` Ubuntu:26.04:LTS	All versions, plus listed versions 12.1-312.1-3build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV