Security Advisory
CVE-2020-1964
9.8
CRITICAL
Vulnerability Description
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Published Date
April 16, 2020
Official Source
NIST NVD Advisory