Apache Heron vulnerabilities

3 CVEs affecting Apache Heron, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-42010, published 2022-10-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11789, published 2019-03-21. High severity, CVSS 7.5. EPSS: 6.9% chance of exploitation in the next 30 days. When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the…
CVE-2020-1964, published 2020-04-16. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types,…
CVE-2021-42010, published 2022-10-24. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.