Heron (Apache) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 140 known versions, newest CVE from 2022-10-24. Vendor: Apache.

CVEs of Heron

• CVE-2021-42010 - CVSS 9.8 (critical), 2022-10-24: Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version…
• CVE-2020-1964 - CVSS 9.8 (critical), 2020-04-16: It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent…
• CVE-2018-11789 - CVSS 7.5 (high), 2019-03-21: When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be…