CVE-2020-1964

published 2020-04-16

CVE-2020-1964: It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	heron	—	—
apache	heron	—	—
apache	heron	—	—

CWE-502