CVE-2020-1964GHSA-HJGM-F7VX-M5G7
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML p
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.20.3-incubating
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Apache Heron
Version range not reported
- org.apache.heron:heron-simulatorMaven
From 0.20.0-incubating · fixed in 0.20.3-incubating
References 5
lists.apache.org
- thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959@<dev.heron.apache.org>
- thread.html/rf032a13a4711f88c0a2c0734eecbee1026cc1b6cde27d16a653f8755@<dev.ignite.apache.org>
- thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67@<dev.ignite.apache.org>
- thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@<dev.ignite.apache.org>
- thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@<user.ignite.apache.org>