~ / search / GHSA-hjgm-f7vx-m5g7

GHSA-hjgm-f7vx-m5g7

Deserialization of Untrusted Data in Apache Heron

Source: GitHub Advisory Database (reviewed) High CVE-2020-1964

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.heron:heron-simulator >= 0.20.0-incubating, < 0.20.3-incubating 0.20.3-incubating

Details

As written in the advisory (Markdown source, shown as plain text).

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).

References

External links from the advisory. They lead to third-party sites.