GHSA-95w5-q9vp-5vrm

Source

https://github.com/advisories/GHSA-95w5-q9vp-5vrm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-95w5-q9vp-5vrm/GHSA-95w5-q9vp-5vrm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-95w5-q9vp-5vrm

Aliases

CVE-2021-42010

Published

2022-10-24T19:00:16Z

Modified

2024-02-16T08:17:51.474693Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Heron allows CRLF log injection

Details

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.

Database specific

{
    "cwe_ids": [
        "CWE-116"
    ],
    "github_reviewed_at": "2022-10-25T20:22:49Z",
    "github_reviewed": true,
    "nvd_published_at": "2022-10-24T14:15:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven / org.apache.heron:heron-api

Package

Name: org.apache.heron:heron-api; View open source insights on deps.dev
Purl: pkg:maven/org.apache.heron/heron-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.20.5-incubating

Affected versions

v0.*

v0.20.1-incubating-rc1

0.*

0.20.0-incubating

0.20.1-incubating-rc2

0.20.1-incubating

0.20.3-incubating

0.20.4-incubating

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-95w5-q9vp-5vrm/GHSA-95w5-q9vp-5vrm.json"