Apache NiFi vulnerable to Deserialization of Untrusted Data
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-34212US | medium6.5 | Exploit | ||
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authori… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/06/12/2WEB
- https://github.com/apache/nifiPACKAGE
- https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6WEB
- https://github.com/apache/nifi/pull/7313WEB
- https://issues.apache.org/jira/browse/NIFI-11614WEB
- https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5WEB
- https://nifi.apache.org/security.html#CVE-2023-34212WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-34212ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan