https://bugzilla.redhat.com/show_bug.cgi?id=1815212
Bug ID: 1815212
Summary: CVE-2020-1953 apache-commons-configuration:
uncontrolled class instantiation when loading YAML
files
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, decathorpe(a)gmail.com,
dfediuck(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
fnasser(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gvarsami(a)redhat.com, hhorak(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lthon(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puebele(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sbonazzo(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com,
smaestri(a)redhat.com, SpikeFedora(a)gmail.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
vbellur(a)redhat.com, yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Commons Configuration uses a third-party library to parse YAML files
which by default allows the instantiation of classes if the YAML includes
special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5,
2.6 did not change the default settings of this library. So if a YAML file was
loaded from an untrusted source, it could therefore load and execute code out
of the control of the host application.
References:
https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b28...
https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1c...
--
You are receiving this mail because:
You are on the CC list for the bug.