Description

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/06/12/2

https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5

https://nifi.apache.org/security.html#CVE-2023-34212

Related Vulnerabilities

CVE-2014-7205 Vulnerability in npm package bassmaster

CVE-2021-36774 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2018-12538 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2020-8203 Vulnerability in maven package org.webjars.bower:lodash

CVE-2018-11698 Vulnerability in npm package node-sass

Severity

High

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory Release Notes