description: It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
problem types: Information Disclosure
affected:
{
product: Apache Heron
vendor: n/a
versions:
status: affected, version: Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, Release v-0.20.0-incubating
}