CVE-2020-1964: Deserialization of Untrusted Data in Apache Heron
Summary
CVE-2020-1964: Deserialization of Untrusted Data in Apache Heron. Affects org.apache.heron:heron-simulator versions >= 0.20.0-incubating, < 0.20.3-incubating. Fixed in 0.20.3-incubating. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Heron is an open-source stream processing engine that provides a distributed, fault-tolerant platform for processing real-time data streams. It is commonly used for building and running large-scale, data-intensive applications. However, versions 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating of Apache Heron have a vulnerability that allows for the deserialization of untrusted data. This vulnerability arises from the improper configuration of the YAML parser, which enables the instantiation of arbitrary types. As a result, remote code execution vulnerabilities can be exploited (CWE-502: Deserialization of Untrusted Data).
Vulnerability Detail
The vulnerability in Apache Heron versions 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating allows for the deserialization of untrusted data. By exploiting this vulnerability, an attacker can execute arbitrary code remotely. This can lead to various security risks, including unauthorized access, data breaches, and system compromise. The vulnerability is classified with a CVSS score of 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
0.20.3-incubating
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to ensure the security of the Apache Heron deployment.
Conclusion
In conclusion, Apache Heron versions 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating are vulnerable to a deserialization issue that allows for the execution of arbitrary code. To mitigate this vulnerability, it is crucial to upgrade to Apache Heron version 0.20.3-incubating or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.heron:heron-simulator →
FAQ
Apache Heron is an open-source stream processing engine used for processing real-time data streams.
The vulnerability allows for the deserialization of untrusted data, which can lead to remote code execution and various security risks.
The CVSS score of this vulnerability is 9.8, indicating a high severity level.
No, there is no known workaround. It is recommended to upgrade to the fixed version.
To fix this vulnerability, upgrade to Apache Heron version 0.20.3-incubating or later.
