Homepage
About Snyk

Deserialization of Untrusted Data Affecting trino package, versions <439-r0

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.4% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-WOLFILATEST-TRINO-6252540
  • published 19 Feb 2024
  • disclosed 20 Aug 2019
Report a new vulnerability Found a mistake?

Introduced: 20 Aug 2019

CVE-2019-10086 Open this link in a new tab
CWE-502 Open this link in a new tab

How to fix?

Upgrade Wolfi trino to version 439-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trino package and not the trino package as distributed by Wolfi. See How to fix? for Wolfi relevant fixed versions and status.

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

References

CVSS Scores

version 3.1
Expand this section

NVD

Recommended
7.3 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    Low
  • Availability (A)
    Low