Deserialization Of Untrusted Data

org.apache.nifi, nifi-asana-processors is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the use of unfiltered Java object serialization and deserialization in the GetAsanaObject Processor, which allows an attacker with access to the configured cache server to supply...

org.apache.nifi:nifi-asana-processors-nar (>=1.20.0, <=2.6.0) potentially affected by CVE-2025-66524 via org.apache.nifi:nifi-asana-processors (>=1.20.0, <=2.6.0)

org.apache.nifi:nifi-asana-processors MAVEN version =1.20.0, =1.20.0, =2.6.0 Source cves: CVE-2025-66524 Source advisory: OSV:GHSA-V4P2-2W39-MHRJ...

org.apache.nifi:nifi-asana-processors-nar (>=1.20.0, <=2.6.0) potentially affected by CVE-2025-66524 via org.apache.nifi:nifi-asana-processors (>=1.20.0, <=2.6.0)

org.apache.nifi:nifi-asana-processors MAVEN version =1.20.0, =1.20.0, =2.6.0 Source cves: CVE-2025-66524 Source advisory: SNYK:JAVA-ORGAPACHENIFI-14545438...

org.apache.nifi:nifi-asana-processors-nar (>=1.20.0, <=2.6.0) potentially affected by CVE-2025-66524 via org.apache.nifi:nifi-asana-processors (>=1.20.0, <=2.6.0)

org.apache.nifi:nifi-asana-processors MAVEN version =1.20.0, =1.20.0, =2.6.0 Source cves: CVE-2025-66524 Source advisory: GHSA-V4P2-2W39-MHRJ...

org.apache.nifi:nifi-asana-processors-nar (>=1.20.0, <=2.6.0) potentially affected by CVE-2025-66524 via org.apache.nifi:nifi-asana-processors (>=1.20.0, <=2.6.0)

org.apache.nifi:nifi-asana-processors MAVEN version =1.20.0, =1.20.0, =2.6.0 Source cves: CVE-2025-66524 Source advisory: MEND:CVE-2025-66524...

CVE-2025-66524: Deserialization of Untrusted Data

Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without...