CVE-2020-1953: Input Validation
A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. If a YAML file was loaded from an untrusted source, it could load and execute code out of the control of the host application.
Other sources
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/commons-configurationto a version that resolves this vulnerability.Fixed in 2.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw in Apache Commons Configuration?
The vulnerability ID for this flaw in Apache Commons Configuration is CVE-2020-1953.
What is the severity level of CVE-2020-1953?
CVE-2020-1953 has a severity level of critical (10).
Which versions of Apache Commons Configuration are affected by CVE-2020-1953?
Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 are affected by CVE-2020-1953.
How can I fix the vulnerability CVE-2020-1953?
To fix the vulnerability CVE-2020-1953, upgrade Apache Commons Configuration to version 2.7.
Where can I find more information about CVE-2020-1953?
You can find more information about CVE-2020-1953 in the references section of the vulnerability description.