Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdxeDQtcHA3Ni12cnFo

Remote code execution in Apache Commons Configuration

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Permalink: https://github.com/advisories/GHSA-7qx4-pp76-vrqh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdxeDQtcHA3Ni12cnFo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago

CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-7qx4-pp76-vrqh, CVE-2020-1953
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-1953
• https://github.com/apache/commons-configuration/commit/add7375cf37fd316d4838c6c56b054fc293b4641
• https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676@%3Ccommits.camel.apache.org%3E
• https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269@%3Ccommits.servicecomb.apache.org%3E
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://github.com/advisories/GHSA-7qx4-pp76-vrqh

Repository: https://github.com/apache/commons-configuration
Blast Radius: 33.6

Affected Packages