Remote Code Execution (RCE)

Apache Flume is vulnerable to remote code execution. The vulnerability exists due to improper validations of jms source and provider url where the attacker can use the jms source with an unsafe provider url causing arbitrary code executions...

org.apache.flume:flume-ng-dist (>=1.5.0, <=1.9.0), org.apache.nifi:nifi-flume-nar (>=0.5.1, <=1.18.0) +1 more potentially affected by CVE-2022-42468 via org.apache.flume.flume-ng-sources:flume-jms-source (>=1.5.0, <=1.10.1)

org.apache.flume.flume-ng-sources:flume-jms-source MAVEN version =1.5.0, =1.5.0, =0.5.1, =1.1.0, =1.18.0 Source cves: CVE-2022-42468 Source advisory: OSV:GHSA-9W4G-FP9H-3Q2V...

org.apache.flume:flume-ng-dist (>=1.5.0, <=1.9.0), org.apache.nifi:nifi-flume-nar (>=0.5.1, <=1.18.0) +1 more potentially affected by CVE-2022-42468 via org.apache.flume.flume-ng-sources:flume-jms-source (>=1.5.0, <=1.10.1)

org.apache.flume.flume-ng-sources:flume-jms-source MAVEN version =1.5.0, =1.5.0, =0.5.1, =1.1.0, =1.18.0 Source cves: CVE-2022-42468 Source advisory: GHSA-9W4G-FP9H-3Q2V...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

Remote code execution

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume (versions 1.4.0–1.10.1) is vulnerable to remote code execution when a JMS Source is configured with an unsafe providerURL, due to JMSSource performing an unvalidated JNDI lookup. The issue is fixed by updating to 1.11.0, which limits JNDI to java protocol or no protocol. Red Hat and ...

CVE-2022-42468: Improper Input Validation

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

org.apache.flume:flume-ng-dist (>=1.5.0, <=1.9.0), org.apache.nifi:nifi-flume-nar (>=0.5.1, <=1.18.0) +1 more potentially affected by CVE-2022-42468 via org.apache.flume.flume-ng-sources:flume-jms-source (>=1.5.0, <=1.10.1)

org.apache.flume.flume-ng-sources:flume-jms-source MAVEN version =1.5.0, =1.5.0, =0.5.1, =1.1.0, =1.18.0 Source cves: CVE-2022-42468 Source advisory: MEND:CVE-2022-42468...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Apache Flume input validation error vulnerability

Apache Flume is a distributed, reliable and available service from the Apache Foundation, USA. Used to efficiently collect, aggregate, and move large amounts of log data, versions of Apache Flume prior to 1.4.0 through 1.10.0 contain a security vulnerability that stems from vulnerability to remot...

Remote Code Execution

flysystem is vulnerable to remote code execution. Lack of proper parameter validation in JMSMessageConsumer allows an attacker to upload and execute malicious code on the system under attack, when a configuration uses a JMS Source with a JNDI LDAP data source URI...

Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

org.apache.flume:flume-ng-dist (>=1.5.0, <=1.9.0), org.apache.nifi:nifi-flume-nar (>=0.5.1, <=1.17.0) +1 more potentially affected by CVE-2022-34916 via org.apache.flume.flume-ng-sources:flume-jms-source (>=1.5.0, <=1.10.0)

org.apache.flume.flume-ng-sources:flume-jms-source MAVEN version =1.5.0, =1.5.0, =0.5.1, =1.1.0, =1.17.0 Source cves: CVE-2022-34916 Source advisory: OSV:GHSA-H9MH-MGPV-GQMV...

org.apache.flume:flume-ng-dist (>=1.5.0, <=1.9.0), org.apache.nifi:nifi-flume-nar (>=0.5.1, <=1.17.0) +1 more potentially affected by CVE-2022-34916 via org.apache.flume.flume-ng-sources:flume-jms-source (>=1.5.0, <=1.10.0)

org.apache.flume.flume-ng-sources:flume-jms-source MAVEN version =1.5.0, =1.5.0, =0.5.1, =1.1.0, =1.17.0 Source cves: CVE-2022-34916 Source advisory: GHSA-H9MH-MGPV-GQMV...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Remote code execution

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...