Description

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/23/2

https://lists.apache.org/thread/j65nwr8n7jchngwqptzh100drcr4ry2q

Related Vulnerabilities

CVE-2021-4264 Vulnerability in npm package dustjs-linkedin

CVE-2020-11971 Vulnerability in maven package org.apache.camel:camel-main

CVE-2020-13957 Vulnerability in maven package org.apache.solr:solr-core

CVE-2021-39153 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2021-30074 Vulnerability in npm package docsify

Severity

Critical

Classification

CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory