WS-2019-0490 | Mend Vulnerability Database

Vulnerability DatabaseWS-2019-0490

WS-2019-0490

Published:May 19, 2026

Updated:May 20, 2026

Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.

Affected Packages

r-r2pmml (CONDA):

Affected version(s) >=0.23.0 <=0.26.0

Fix Suggestion:

Update to version no_fix

dropseq_tools (CONDA):

Affected version(s) =1.13 <2.0.0

Fix Suggestion:

Update to version 2.0.0

bioconductor-fastreer (CONDA):

Affected version(s) >=1.2.0 <=1.4.0

Fix Suggestion:

Update to version no_fix

existdb (CONDA):

Affected version(s) =4.3.1 <4.4.0

Fix Suggestion:

Update to version 4.4.0

mgf-formatter (CONDA):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) >=0.27.0 <0.31.0

Fix Suggestion:

Update to version 0.31.0

mzmine (CONDA):

Affected version(s) >=3.6.0 <=3.9.0

Fix Suggestion:

Update to version no_fix

fgbio (CONDA):

Affected version(s) >=0.1.2a <0.2.0

Fix Suggestion:

Update to version 0.2.0

gradle (CONDA):

Affected version(s) >=6.4.0 <7.0.0

Fix Suggestion:

Update to version 7.0.0

existdb (CONDA):

Affected version(s) >=4.5.0 <=4.7.1

Fix Suggestion:

Update to version no_fix

fiji (CONDA):

Affected version(s) >=20220414 <=20250206

Fix Suggestion:

Update to version no_fix

beakerx (CONDA):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

sklearn2pmml (CONDA):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

watchdog-wms (CONDA):

Affected version(s) >=1.2.3b <2.0.5

Fix Suggestion:

Update to version 2.0.5

eoulsan (CONDA):

Affected version(s) >=2.4 <=2.5

Fix Suggestion:

Update to version no_fix

nextflow (CONDA):

Affected version(s) =0.31.1 <0.32.0

Fix Suggestion:

Update to version 0.32.0

mpa-portable (CONDA):

Affected version(s) >=1.4.1 <=2.0.0

Fix Suggestion:

Update to version no_fix

fgbio (CONDA):

Affected version(s) >=0.2.1a <0.4.0

Fix Suggestion:

Update to version 0.4.0

openrefine (CONDA):

Affected version(s) >=3.4 <3.5.0

Fix Suggestion:

Update to version 3.5.0

gradle (CONDA):

Affected version(s) >=5.3.1 <6.3.0

Fix Suggestion:

Update to version 6.3.0

sklearn2pmml (CONDA):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

eoulsan (CONDA):

Affected version(s) >=2.0_beta4 <2.3

Fix Suggestion:

Update to version 2.3

nextflow (CONDA):

Affected version(s) >=19.01.0 <=23.10.0

Fix Suggestion:

Update to version no_fix

com.beust:jcommander (JAVA):

Affected version(s) >=1.58 <1.78

Fix Suggestion:

Update to version 1.78

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20210317.94906 <203.0.20201127.95230-eap09

Fix Suggestion:

Update to version 203.0.20201127.95230-eap09

allurereport.generator (NUGET):

Affected version(s) =0.1.0

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend2 (NUGET):

Affected version(s) =203.0.20201229.161815 <203.0.20200923.135724-eap01

Fix Suggestion:

Update to version 203.0.20200923.135724-eap01

ddkits/cli (PHP):

Affected version(s) =dev-New2 <dev-beta2

Fix Suggestion:

Update to version dev-beta2

hyuel/box (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

ddkits/cli (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/tough-cookie-4.1.3 <4.20

Fix Suggestion:

Update to version 4.20

dsiddharth2/php-zxing (PHP):

Affected version(s) >=dev-dev <1.0.0

Fix Suggestion:

Update to version 1.0.0

polozpavlo/allure (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

sklearn2pmml (PYTHON):

Affected version(s) >=0.67.0 <=0.81.0

Fix Suggestion:

Update to version no_fix

sklearn2pmml (PYTHON):

Affected version(s) >=0.64.0 <0.66.0

Fix Suggestion:

Update to version 0.66.0

beakerx (PYTHON):

Affected version(s) >=1.4.0 <=1.4.1

Fix Suggestion:

Update to version no_fix

Related Resources (1)

https://github.com/cbeust/jcommander/commit/3ae95595febbed9c13f367b6bda5c0be1c572c53

Do you need more information?

CVSS v4

Base Score:

9.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH