Design/Logic Flaw

When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the...

CVE-2022-26850

CVE-2022-26850 affects Apache NiFi (pre-1.16) where during creation/update of single-user credentials a copy of the Login Identity Providers configuration was written to the OS temporary directory, which often has global read permissions. The temporary file was moved to the final configuration di...

CVE-2022-26850 Insufficiently protected credentials

When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the...

CVE-2022-26850 Insufficiently protected credentials

When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the...

Apache NiFi 安全漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. A security vulnerability exists in Apache NiFi that stems from the fact that when creating or updating credentials...

GHSA-57J2-W4CX-62H2 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1, scala, management-api-for-apache-cassandra-4.0, cassandra-reaper...

GHSA-57J2-W4CX-62H2 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, cassandra-reaper, scala...

CVE-2020-36518 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1, scala, management-api-for-apache-cassandra-4.0, cassandra-reaper...

CVE-2020-36518 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, cassandra-reaper, scala...

GHSA-RFMP-JVR7-HX78 Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

GHSA-3PP3-77J6-8PH6 Missing Authentication for Critical Function in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

GHSA-G644-PR5V-VPPF Insertion of Sensitive Information into Log File in Apache NiFi Stateless

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

Insertion of Sensitive Information into Log File in Apache NiFi Stateless

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

GHSA-Q4XF-3PMQ-3HW8 Improper Restriction of XML External Entity Reference in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Improper Restriction of XML External Entity Reference in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Insertion of Sensitive Information into Log File in Apache NiFi

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

GHSA-7Q8G-GPFP-V8GX Insertion of Sensitive Information into Log File in Apache NiFi

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

org.apache.nifi:nifi-administration (=1.10.0), org.apache.nifi:nifi-authorizer (=1.10.0) +22 more potentially affected by CVE-2020-1928 via org.apache.nifi:nifi-parameter (=1.10.0)

org.apache.nifi:nifi-parameter MAVEN version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-parameter and may be impacted: - org.apache.nifi:nifi-administration =1.10.0 - org.apache.nifi:nifi-authorizer =1.10.0 -...

Apache NiFi Insertion of Sensitive Information into Log File

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present...