Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 11 Mar 2020 12:32:54 +0800
From: Chen QingYang <>
Subject: [CVE-2020-1947] Apache ShardingSphere(incubator) deserialization vulnerability

CVE-2020-1947: Apache ShardingSphere(incubator) deserialization

Severity: low

The Apache Software Foundation

Versions Affected:
ShardingSphere 4.0.0-RC3, 4.0.0

Apache ShardingSphere's web console uses the SnakeYAML library for parsing
YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal
data to a Java type By using the YAML tag. Unmarshalling untrusted data can
lead to security flaws of RCE.

4.0.0-RC3 and 4.0.0 users should upgrade to 4.0.1

An attacker can use untrusted data to fill in the DataSource Config after
login the sharding-ui.

This issue was discovered by WuXiong of QI`ANXIN YUNYING Labs.


Chen QingYang
Apache ShardingSphere

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.