title: CRLF log injection
description: Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.
problem types: CRLF Injection
affected:
{
vendor: Apache Software Foundation
product: Apache Heron (Incubating)
versions:
version: Apache Heron 0.20.4-incubating, status: affected, lessThanOrEqual: 0.20.4-incubating, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'low'}
]