id: PYSEC-2021-435
details: Improper output neutralization for Logs. A specific Apache Superset HTTP
  endpoint allowed for an authenticated user to forge log entries or inject malicious
  content into logs.
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.3.2
  versions:
  - 0.34.0
  - 0.34.1
  - 0.35.1
  - 0.35.2
  - 0.36.0
  - 0.37.0
  - 0.37.1
  - 0.37.2
  - 0.38.0
  - 0.38.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
references:
- type: WEB
  url: https://lists.apache.org/thread/53lkszw6d3tybp5t99nvgcj538b9trw9
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2021/11/17/2
- type: ADVISORY
  url: https://github.com/advisories/GHSA-5fp8-c45m-256p
aliases:
- CVE-2021-42250
- GHSA-5fp8-c45m-256p
modified: "2021-11-29T23:10:59.097625Z"
published: "2021-11-17T15:15:00Z"