Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2020-1953

critique

CVE-2020-1953

apache-commons-configuration: uncontrolled class instantiation when loading YAML files

Publiée Modifiée
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (élevée), Ubuntu (moyenne).

Description

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
maven::GitHub Security Advisory Mavenorg.apache.commons:commons-configuration22.7
debian 10commons-configuration22.2-1+deb10u1
debian 11commons-configuration22.7-1
debian 12commons-configuration22.7-1
debian 13commons-configuration22.7-1
debian 14commons-configuration22.7-1
echocommons-configuration22.7-1
ubuntu 18.04-ESMcommons-configuration2pas de correctif indiqué
ubuntu 20.04-ESMcommons-configuration2pas de correctif indiqué

Références

Les 9 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.