Skip to content
OpenAdvisories
Unscored CVE-2020-11986 EUVD-2020-4309GHSA-cj3p-fc7w-fx87

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of…

Published Sep 9, 2020 · Updated Aug 4, 2024 · Assigned by apache

Package: netbeans Package: netbeans Ecosystem: Debian Ecosystem: Ubuntu

Description

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.

Affected products

VendorProductAffectedFixed
— Apache NetBeans Apache NetBeans up to 12.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netbeans 12.1-1 —
Debian 13 netbeans 12.1-1 —
Debian 12 netbeans 12.1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netbeans No fix yet —
Ubuntu 26.04 LTS netbeans No fix yet —
Ubuntu 25.10 netbeans No fix yet —
Ubuntu 24.04 LTS netbeans No fix yet —
Ubuntu 22.04 LTS netbeans No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS netbeans No fix yet —
Ubuntu 18.04 LTS netbeans No fix yet —
Ubuntu 16.04 LTS netbeans No fix yet —

References