CVE-2020-1964

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-1964
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1964.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-1964
Aliases
Published
2020-04-16T19:15:28.290Z
Modified
2026-03-10T23:13:26.352876Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).

References

Affected packages

Git / github.com/apache/incubator-heron

Affected ranges

Type
GIT
Repo
https://github.com/apache/incubator-heron
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
45043bb6dcef1e8089c0834f17f8be0cc3f451d3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
40ccec635b45191593ff984a9ae81fd4e0a5dadd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b069e450a78c2f77ba5427c3f1aceda1e881e9f2
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.20.0-incubating"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.20.1-incubating-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.20.2-incubating"
        }
    ]
}

Affected versions

0.*
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.14.5
0.14.8
0.14.9
0.15.0
0.15.0-rc1
0.15.1
0.15.1.5
0.15.2
0.15.2rc1
0.15.2rc2
0.15.2rc3
0.15.3
0.15.3rc1
0.16.0
0.16.0.1
0.16.1
0.16.2
0.16.3
0.16.4
0.16.4.1
0.16.5
0.16.5.1
0.16.5.3
0.17.0
0.17.1
0.17.2
0.17.2.1
0.17.2.2
0.17.3
0.17.3.1
0.17.4
0.17.4.1
0.17.5
0.17.5.1
0.17.6
0.17.7
0.17.8
0.18.0.1
0.18.0.1-tw-1
0.19.0.10
0.19.0.2
0.19.0.3
0.19.0.4
0.19.0.5
0.19.0.6
0.19.0.7
0.19.0.8
0.19.0.9
v-0.*
v-0.20.0-incubating
v-0.20.0-incubating-candidate-1
v-0.20.0-incubating-candidate-1-test
v-0.20.0-incubating-candidate-2
v-0.20.0-incubating-candidate-3
v-0.20.0-incubating-candidate-4
v-0.20.0-incubating-candidate-5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1964.json"