VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 11, 2020· Updated Jun 17, 2026

CVE-2020-1947

CVE-2020-1947

Description

In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.shardingsphere:shardingsphereMaven
>= 4.0.0-RC3, < 4.0.14.0.1

Affected products

4
  • Apache/ShardingSphere2 versions
    cpe:2.3:a:apache:shardingsphere:4.0.0:-:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:shardingsphere:4.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:apache:shardingsphere:4.0.0:rc3:*:*:*:*:*:*
  • Apache Software Foundation/Apache ShardingSphere(incubator)v5
    Range: 4.0.0-RC3
  • ghsa-coords
    pkg:maven/org.apache.shardingsphere/shardingsphere
    Range: >= 4.0.0-RC3, < 4.0.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.