Huangzhicong

**Name of the Vulnerable Software and Affected Versions** Apache UIMA Java SDK versions prior to 3.5.0 **Description** The issue is related to the deserialization of untrusted data and improper input validation in the Apache UIMA Java SDK. This affects several locations in the code, including the deserialization of Java-serialized CAS, CAS Editor Eclipse plugin, Vinci Analysis Engine service, CasAnnotationViewerApplet, CasTreeViewerApplet, and the checkpointing feature of the CPE module. The unrestricted deserialization of Java-serialized CAS files may allow arbitrary remote code execution. Users or developers who use the CasIOUtils in their own applications and services to parse serialized CAS data are affected unless they ensure that the data passed to CasIOUtils is not a serialized Java object. **Recommendations** To resolve the issue, upgrade to Apache UIMA Java SDK version 3.5.0, which fixes the issue. For users running on Java 9+ platforms, configure a filter pattern through the "jdk.serialFilter" system property to allow deserializing specific classes, and use "!*" as the final component to disallow deserialization of any classes not listed in the pattern. For Java 1.8, upgrade to a recent Java version to secure the affected UIMA version, as Java 1.8 does not support the ObjectInputFilter.

**Name of the Vulnerable Software and Affected Versions** Apache Atlas versions 0.8.4 through 2.2.0 **Description** A vulnerability in the import module of Apache Atlas allows an authenticated user to write to the web server filesystem. **Recommendations** For Apache Atlas versions 0.8.4 through 2.2.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the import module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache UIMA versions prior to 3.3.0 **Description** A relative path traversal vulnerability in the FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. PEAR files should never be installed into a UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine. **Recommendations** For versions prior to 3.3.0, consider restricting the installation of PEAR files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, carefully validate the ZIP entry names in PEAR archives before installation.