CVE-2020-1947

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

Code injection

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

CVE-2020-1947

CVE-2020-1947 affects Apache ShardingSphere (incubator) 4.0.0-RC3 and 4.0.0. The web console uses SnakeYAML to parse YAML for datasource config; untrusted YAML can be unmarshaled to a Java type via YAML tags, enabling remote code execution (RCE). Impact described as potential arbitrary code execu...

CVE-2020-1947

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

Apache ShardingSphere Remote Code Execution Vulnerability

Apache ShardingSphere is an open source ecosystem of distributed database middleware solutions. It consists of Sharding-JDBC, Sharding-Proxy, and Sharding-Sidecar planned, which are three independent products. Sharding-Sidecar planned, which consists of three mutually independent products. A remo...