Lucene search
PRIOn knowledge basePRION:CVE-2023-34212HistoryJun 12, 2023 - 4:15 p.m.
Deserialization of untrusted data
2023-06-1216:15:00
PRIOn knowledge base
www.prio-n.com
8
apache nifi
jndi
deserialization
vulnerability
fix
1.22.0
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Related
osv
osv
Apache NiFi vulnerable to Deserialization of Untrusted Data
2023-06-12 18:30:18
CVE-2023-34212
2023-06-12 16:15:10
cve
cve
CVE-2023-34212
2023-06-12 16:15:10
veracode
veracode
Deserialization Of Untrusted Data
2023-06-15 02:15:49
cvelist
cvelist
nvd
nvd
CVE-2023-34212
2023-06-12 16:15:10
github
github
Apache NiFi vulnerable to Deserialization of Untrusted Data
2023-06-12 18:30:18