WS-2019-0490 | Mend Vulnerability Database

Vulnerability DatabaseWS-2019-0490

WS-2019-0490

Published:May 14, 2026

Updated:May 14, 2026

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Affected Packages

sklearn2pmml (CONDA):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

gradle (CONDA):

Affected version(s) >=5.3.1 <6.3.0

Fix Suggestion:

Update to version 6.3.0

mzmine (CONDA):

Affected version(s) >=3.6.0 <=3.9.0

Fix Suggestion:

Update to version no_fix

eoulsan (CONDA):

Affected version(s) >=2.0_beta4 <2.3

Fix Suggestion:

Update to version 2.3

watchdog-wms (CONDA):

Affected version(s) >=1.2.3b <2.0.5

Fix Suggestion:

Update to version 2.0.5

beakerx (CONDA):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

existdb (CONDA):

Affected version(s) =4.3.1 <4.4.0

Fix Suggestion:

Update to version 4.4.0

eoulsan (CONDA):

Affected version(s) >=2.4 <=2.5

Fix Suggestion:

Update to version no_fix

sklearn2pmml (CONDA):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

fgbio (CONDA):

Affected version(s) >=0.1.2a <0.2.0

Fix Suggestion:

Update to version 0.2.0

fgbio (CONDA):

Affected version(s) >=0.2.1a <0.4.0

Fix Suggestion:

Update to version 0.4.0

bioconductor-fastreer (CONDA):

Affected version(s) >=1.2.0 <=1.4.0

Fix Suggestion:

Update to version no_fix

dropseq_tools (CONDA):

Affected version(s) =1.13 <2.0.0

Fix Suggestion:

Update to version 2.0.0

mgf-formatter (CONDA):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) >=0.27.0 <0.31.0

Fix Suggestion:

Update to version 0.31.0

gradle (CONDA):

Affected version(s) >=6.4.0 <7.0.0

Fix Suggestion:

Update to version 7.0.0

openrefine (CONDA):

Affected version(s) >=3.4 <3.5.0

Fix Suggestion:

Update to version 3.5.0

fiji (CONDA):

Affected version(s) >=20220414 <=20250206

Fix Suggestion:

Update to version no_fix

mpa-portable (CONDA):

Affected version(s) >=1.4.1 <=2.0.0

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) =0.31.1 <0.32.0

Fix Suggestion:

Update to version 0.32.0

existdb (CONDA):

Affected version(s) >=4.5.0 <=4.7.1

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) >=19.01.0 <=23.10.0

Fix Suggestion:

Update to version no_fix

r-r2pmml (CONDA):

Affected version(s) >=0.23.0 <=0.26.0

Fix Suggestion:

Update to version no_fix

com.beust:jcommander (JAVA):

Affected version(s) >=1.58 <1.78

Fix Suggestion:

Update to version 1.78

allurereport.generator (NUGET):

Affected version(s) =0.1.0

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20201229.161815 <203.0.20200923.135724-eap01

Fix Suggestion:

Update to version 203.0.20200923.135724-eap01

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20210317.94906 <203.0.20201127.95230-eap09

Fix Suggestion:

Update to version 203.0.20201127.95230-eap09

polozpavlo/allure (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

ddkits/cli (PHP):

Affected version(s) =dev-New2 <dev-beta2

Fix Suggestion:

Update to version dev-beta2

hyuel/box (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

ddkits/cli (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/tough-cookie-4.1.3 <4.20

Fix Suggestion:

Update to version 4.20

dsiddharth2/php-zxing (PHP):

Affected version(s) >=dev-dev <1.0.0

Fix Suggestion:

Update to version 1.0.0

beakerx (PYTHON):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

sklearn2pmml (PYTHON):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

sklearn2pmml (PYTHON):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

Related Resources (1)

https://github.com/cbeust/jcommander/commit/3ae95595febbed9c13f367b6bda5c0be1c572c53

Do you need more information?

CVSS v4

Base Score:

9.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH