cbcvebase.
CVE-2020-1953
published 2020-03-13

CVE-2020-1953: Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special…

PriorityP262critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
6.68%
93.1th percentile
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Affected

20 ranges
VendorProductVersion rangeFixed in
apacheapache_commons_configuration
apacheapache_commons_configuration
apacheapache_commons_configuration
apacheapache_commons_configuration
apacheapache_commons_configuration
apachecommons_configuration
apachecommons_configuration
apachecommons_configuration
apachecommons_configuration
apachecommons_configuration
debiancommons-configuration2< commons-configuration2 2.7-1 (bookworm)commons-configuration2 2.7-1 (bookworm)
oracledatabase_server
oracledatabase_server
oracledatabase_server
oracledatabase_server
oracledatabase_server
oraclehealthcare_foundation
oraclehealthcare_foundation
oraclehealthcare_foundation
oraclehealthcare_foundation

Detection & IOCsextracted from sources · hover to see the quote

  • Trigger condition: YAML file loaded from an untrusted source containing special statements that instantiate arbitrary classes — look for YAML payloads with class instantiation directives (e.g., SnakeYAML '!!' tags) being parsed by Apache Commons Configuration 2.2–2.6
  • Upstream patch commit to diff for detection of the fix (SafeConstructor enforcement): https://github.com/apache/commons-configuration/commit/add7375cf37fd316d4838c6c56b054fc293b4641
  • ·Only Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, and 2.6 are affected; packages that do not include YAML configuration support are NOT affected regardless of version.
  • ·Several Red Hat packages are unaffected because they do not include support for YAML configurations: apache-commons-configuration (RHEL 7), apache-commons-configuration (Red Hat Enterprise Virtualization), rh-maven35-apache-commons-configuration (Red Hat Software Collections), commons-configuration (Red Hat Gluster Storage).
  • ·There is currently no mitigation available for this vulnerability; the fix requires upgrading to version 2.7 or later.

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_oracle10.0CRITICAL
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.