CVE-2020-1953 Remote code execution in Apache Commons Configuration
Attackers can execute arbitrary code by supplying malicious YAML files to applications using Apache Commons Configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1953?
CVE-2020-1953 is a critical unsafe deserialization vulnerability in Oracle Database Server, published on 13 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Which versions are affected by CVE-2020-1953?
2 open source packages ship an affected version, including org.apache.commons:commons-configuration2. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-configuration2 Maven | From 2.2 | 2.7 |
org.apache.commons:commons-configuration2 Maven | From 2.2 | 2.7 |
Products include Apache Commons Configuration, Oracle Database Server, Oracle Healthcare Foundation.
How do I fix CVE-2020-1953?
Upgrade org.apache.commons:commons-configuration2 to 2.7 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-1953 being exploited?
There is no known exploitation of CVE-2020-1953 in the wild and no public exploit code.
Other vulnerabilities in Oracle Database Server
- CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults
- CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
- CVE-2025-46392 Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
- CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
- CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles
Sources
Also known as DEBIAN-CVE-2020-1953, GHSA-7qx4-pp76-vrqh, UBUNTU-CVE-2020-1953.