Description
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Heron | Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, Release v-0.20.0-incubating | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.heron:heron-simulator | >= 0.20.0-incubating, < 0.20.3-incubating | 0.20.3-incubating | GHSA-hjgm-f7vx-m5g7 |
References
- https://lists.apache.org/thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959%40%3Cdev.heron.apache.org%3E
- [ignite-dev] 20200605 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list
- [ignite-dev] 20200608 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list
- [ignite-dev] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list
- [ignite-user] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list