Apache · Apache Db Ddlutils · CVE-2021-41616
**Name of the Vulnerable Software and Affected Versions**
Apache DB DdlUtils version 1.0
**Description**
The BinaryObjectsHelper class in Apache DB DdlUtils was insecure and used `ObjectInputStream.readObject` without validating the input data, making it unsafe to deserialize. This class was intended for migrating database data with SQL binary types between databases. The DdlUtils project is no longer actively developed. Changes have been made to address the insecurity, including removing the BinaryObjectsHelper class and the ddlutils-1.0 release from distribution.
**Recommendations**
For Apache DB DdlUtils version 1.0, the following changes have been made to address the issue:
1. The BinaryObjectsHelper.java file has been deleted from the DdlUtils source repository.
2. The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure.
3. The DdlUtils website has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.