Apache Heron vulnerabilities

3 vulnerabilities

Known vulnerabilities in Apache Heron, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.8CVE-2018-11789apacheheron
EPSS score
6.92%
When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd.9.8CVE-2021-42010apache software foundationapache heron (incubating)+2
EPSS score
1.58%
Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.9.8CVE-2020-1964apacheheron+1
EPSS score
4.81%
It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).