PT-2020-4488 · Apache · Apache Commons Configuration

Published 2020-03-13 · Updated 2021-07-21 · CVE-2020-1953

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Commons Configuration versions 2.2 through 2.6

Description The issue is related to the parsing of YAML files by a third-party library used in Apache Commons Configuration. By default, this library allows the instantiation of classes if the YAML includes special statements. This could lead to the execution of code out of the control of the host application if a YAML file is loaded from an untrusted source. The vulnerability is also associated with insufficient input validation, which could allow a remote attacker to execute arbitrary code.

Recommendations For Apache Commons Configuration versions 2.2 through 2.6, consider disabling the loading of YAML files from untrusted sources as a temporary workaround until a patch is available. Restrict access to the YAML parsing functionality to minimize the risk of exploitation. Avoid using the YAML parsing library with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05036

CVE-2020-1953

GHSA-7QX4-PP76-VRQH

Affected Products

Apache Commons Configuration

References · 20

• https://cve.org/CVERecord?id=CVE-2020-1953 · Security Note
• https://ubuntu.com/security/CVE-2020-1953 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1953 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1953 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05036 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1953 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7qx4-pp76-vrqh · Vendor Advisory
• https://github.com/apache/commons-configuration/commit/add7375cf37fd316d4838c6c56b054fc293b4641 · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note
• https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269@%3Ccommits.servicecomb.apache.org%3E · Note
• https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E · Note
• https://t.me/cvenotify/7530 · Telegram Post
• https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E · Note