Description

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/23/2

https://lists.apache.org/thread/j65nwr8n7jchngwqptzh100drcr4ry2q

Related Vulnerabilities

CVE-2019-10364 Vulnerability in maven package org.jenkins-ci.plugins:ec2

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-toml

CVE-2023-22579 Vulnerability in npm package @sequelize/core

CVE-2022-24441 Vulnerability in npm package snyk

CVE-2023-30867 Vulnerability in maven package org.apache.streampark:streampark

Severity

Critical

Classification

CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory