Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.heron:heron-simulator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Deserialization of Untrusted Data in Apache Heron

    CVE-2020-1964 · GHSA-hjgm-f7vx-m5g7

    Affected
    • Maven org.apache.heron:heron-simulator >= 0.20.0-incubating, <= 0.20.2-incubating
    Fixed in
    0.20.3-incubating· Vendor fix available
    Issue
    It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).

    Recommended action: Upgrade to 0.20.3-incubating (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →