GitHub Advisory DatabaseGHSA-65WH-G8X8-GM2HApache NiFi vulnerable to Deserialization of Untrusted Data
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
52.9%
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.nifi:nifi-jms-bundle | lt | 1.22.0 |
References
www.openwall.com/lists/oss-security/2023/06/12/2
github.com/advisories/GHSA-65wh-g8x8-gm2h
github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
github.com/apache/nifi/pull/7313
issues.apache.org/jira/browse/NIFI-11614
lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5
nifi.apache.org/security.html#CVE-2023-34212
nvd.nist.gov/vuln/detail/CVE-2023-34212
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
52.9%