CVE-2021-42010

CWE-1164 documents4 sources
Severity
9.8CRITICAL
EPSS
1.8%
top 17.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache HeronApache Software Foundation Apache Heron (incubating)
Timeline
PublishedOct 24

Description

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_heron_(incubating)Apache Heron 0.20.4-incubating — 0.20.4-incubating
▶NVDapache/heron< 0.20.5-incubating
▶Mavenorg.apache.heron:heron-api< 0.20.5-incubating

🔴Vulnerability Details

3
OSV
Heron allows CRLF log injection↗2022-10-24
▶
GHSA
Heron allows CRLF log injection↗2022-10-24
▶
CVEList
CRLF log injection↗2022-10-24
▶
CVE-2021-42010 (CRITICAL CVSS 9.8) | Heron versions <= 0.20.4-incubating | cvebase.io