CVE catalog
CVE-2019-0227
axis: CVE-2019-0227
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 91.94% · Oct 25, 2026
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | axis | sid | 1.4-30 | fixed |
| Debian | axis | forky | 1.4-30 | fixed |
| Debian | axis | trixie | 1.4-29 | vulnerable |
| Debian | axis | bookworm | 1.4-28+deb12u1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | axis | source | sid | 1.4-30 | unimportant | Not reported | [929266] |
| Debian | axis | source | forky | 1.4-30 | unimportant | Not reported | [929266] |
| Debian | axis | source | trixie | (unfixed) | unimportant | Not reported | [929266] |
| Debian | axis | source | bookworm | (unfixed) | unimportant | Not reported | [929266] |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libaxis-java]Unknown
Source package: [axis]
Details (2)
1.4-28+deb12u1· all · bookwormAffected
dsa · axis · debian · bookworm; dsa · axis · debian · 12
1.4-28+deb12u1· all · bookwormAffected
dsa · axis · debian · bookworm; dsa · axis · debian · 12
- [libaxis-java-doc]Unknown
Source package: [axis]
Details (2)
1.4-28+deb12u1· all · bookwormAffected
dsa · axis · debian · bookworm; dsa · axis · debian · 12
1.4-28+deb12u1· all · bookwormAffected
dsa · axis · debian · bookworm; dsa · axis · debian · 12
[Debian 13 (Trixie)]
- [libaxis-java]Unknown
Source package: [axis]
Details (2)
1.4-29· all · trixieAffected
dsa · axis · debian · 13
1.4-29· all · trixieAffected
dsa · axis · debian · 13
- [libaxis-java-doc]Unknown
Source package: [axis]
Details (2)
1.4-29· all · trixieAffected
dsa · axis · debian · 13
1.4-29· all · trixieAffected
dsa · axis · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2019-0227]
- [https://security-tracker.debian.org/tracker/CVE-2019-0227]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0273.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]