WS-2019-0490 | Mend Vulnerability Database

Vulnerability DatabaseWS-2019-0490

WS-2019-0490

Published:May 19, 2026

Updated:May 20, 2026

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Affected Packages

eoulsan (CONDA):

Affected version(s) >=2.4 <=2.5

Fix Suggestion:

Update to version no_fix

beakerx (CONDA):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

gradle (CONDA):

Affected version(s) >=6.4.0 <7.0.0

Fix Suggestion:

Update to version 7.0.0

nextflow (CONDA):

Affected version(s) =0.31.1 <0.32.0

Fix Suggestion:

Update to version 0.32.0

bioconductor-fastreer (CONDA):

Affected version(s) >=1.2.0 <=1.4.0

Fix Suggestion:

Update to version no_fix

fgbio (CONDA):

Affected version(s) >=0.2.1a <0.4.0

Fix Suggestion:

Update to version 0.4.0

existdb (CONDA):

Affected version(s) =4.3.1 <4.4.0

Fix Suggestion:

Update to version 4.4.0

r-r2pmml (CONDA):

Affected version(s) >=0.23.0 <=0.26.0

Fix Suggestion:

Update to version no_fix

mgf-formatter (CONDA):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

mzmine (CONDA):

Affected version(s) >=3.6.0 <=3.9.0

Fix Suggestion:

Update to version no_fix

mpa-portable (CONDA):

Affected version(s) >=1.4.1 <=2.0.0

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) >=19.01.0 <=23.10.0

Fix Suggestion:

Update to version no_fix

existdb (CONDA):

Affected version(s) >=4.5.0 <=4.7.1

Fix Suggestion:

Update to version no_fix

fiji (CONDA):

Affected version(s) >=20220414 <=20250206

Fix Suggestion:

Update to version no_fix

gradle (CONDA):

Affected version(s) >=5.3.1 <6.3.0

Fix Suggestion:

Update to version 6.3.0

dropseq_tools (CONDA):

Affected version(s) =1.13 <2.0.0

Fix Suggestion:

Update to version 2.0.0

openrefine (CONDA):

Affected version(s) >=3.4 <3.5.0

Fix Suggestion:

Update to version 3.5.0

sklearn2pmml (CONDA):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

fgbio (CONDA):

Affected version(s) >=0.1.2a <0.2.0

Fix Suggestion:

Update to version 0.2.0

eoulsan (CONDA):

Affected version(s) >=2.0_beta4 <2.3

Fix Suggestion:

Update to version 2.3

nextflow (CONDA):

Affected version(s) >=0.27.0 <0.31.0

Fix Suggestion:

Update to version 0.31.0

watchdog-wms (CONDA):

Affected version(s) >=1.2.3b <2.0.5

Fix Suggestion:

Update to version 2.0.5

sklearn2pmml (CONDA):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

com.beust:jcommander (JAVA):

Affected version(s) >=1.58 <1.78

Fix Suggestion:

Update to version 1.78

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20201229.161815 <203.0.20200923.135724-eap01

Fix Suggestion:

Update to version 203.0.20200923.135724-eap01

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20210317.94906 <203.0.20201127.95230-eap09

Fix Suggestion:

Update to version 203.0.20201127.95230-eap09

allurereport.generator (NUGET):

Affected version(s) =0.1.0

Fix Suggestion:

Update to version no_fix

ddkits/cli (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/tough-cookie-4.1.3 <4.20

Fix Suggestion:

Update to version 4.20

dsiddharth2/php-zxing (PHP):

Affected version(s) >=dev-dev <1.0.0

Fix Suggestion:

Update to version 1.0.0

ddkits/cli (PHP):

Affected version(s) =dev-New2 <dev-beta2

Fix Suggestion:

Update to version dev-beta2

hyuel/box (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

polozpavlo/allure (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

beakerx (PYTHON):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

sklearn2pmml (PYTHON):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

sklearn2pmml (PYTHON):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

Related Resources (1)

https://github.com/cbeust/jcommander/commit/3ae95595febbed9c13f367b6bda5c0be1c572c53

Do you need more information?

CVSS v4

Base Score:

9.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH