QwikSec

Security Database

CVE

CWE

Training

CVE-2020-1964

Published: Apr 16, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).

Vendor	Product	Versions
n/a	Apache Heron	affected `Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, Release v-0.20.0-incubating`

References

https://lists.apache.org/thread.html/r16dd39f4180e4443ef4ca774a3a5a3d7ac69f91812c183ed2a99e959%40%3Cdev.heron.apache.org%3E

x_refsource_MISC

[ignite-dev] 20200605 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability

mailing-list

x_refsource_MLIST

[ignite-dev] 20200608 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability

mailing-list

x_refsource_MLIST

[ignite-dev] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability

mailing-list

x_refsource_MLIST

[ignite-user] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.