org.apache.uima:uimaj-tools 3.0.0-alpha02 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.uima:uimaj-tools package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data org.apache.uima:uimaj-tools is a library tooling supporting UIMA use. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the `CasIOUtils` class. An attacker can execute arbitrary code by deserializing unverified Java objects. This is only exploitable if the user or developer has actively chosen to start a service that is remotely accessible, such as Vinci, or if they use the `CasIOUtils` in their own applications and services to parse untrusted serialized CAS data. How to fix Deserialization of Untrusted Data? Upgrade `org.apache.uima:uimaj-tools` to version 3.5.0 or higher.	[,3.5.0)
M XML External Entity (XXE) Injection org.apache.uima:uimaj-tools is a library tooling supporting UIMA use. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. As part of its configuration and operation, UIMA may read XML from various sources. An attacker may craft malicious XML file which could inadvertently disclose local files or other internal content. How to fix XML External Entity (XXE) Injection? Upgrade `org.apache.uima:uimaj-tools` to version 2.10.2, 3.0.0-beta or higher.	[,2.10.2)[3.0.0-alpha,3.0.0-beta)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

org.apache.uima:uimaj-tools is a library tooling supporting UIMA use.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the CasIOUtils class. An attacker can execute arbitrary code by deserializing unverified Java objects. This is only exploitable if the user or developer has actively chosen to start a service that is remotely accessible, such as Vinci, or if they use the CasIOUtils in their own applications and services to parse untrusted serialized CAS data.

How to fix Deserialization of Untrusted Data?

Upgrade org.apache.uima:uimaj-tools to version 3.5.0 or higher.

[,3.5.0)

XML External Entity (XXE) Injection

org.apache.uima:uimaj-tools is a library tooling supporting UIMA use.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. As part of its configuration and operation, UIMA may read XML from various sources. An attacker may craft malicious XML file which could inadvertently disclose local files or other internal content.

How to fix XML External Entity (XXE) Injection?

Upgrade org.apache.uima:uimaj-tools to version 2.10.2, 3.0.0-beta or higher.

[,2.10.2)[3.0.0-alpha,3.0.0-beta)

org.apache.uima:uimaj-tools@3.0.0-alpha02 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically