CVE-2020-1953

A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. If a YAML file was loaded from an untrusted source, it could load and execute code out of the control of the host application.

Several packages are unaffected because they do not include support for YAML configurations:

• apache-commons-configuration as shipped with Red Hat Enterprise Linux 7
• apache-commons-configuration as shipped with Red Hat Enterprise Virtualization
• rh-maven35-apache-commons-configuration as shipped with Red Hat Software Collections
• commons-configuration as shipped with Red Hat Gluster Storage

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is currently no mitigation available for this vulnerability.