org.apache.nifi:nifi-framework-nar (>=1.0.0 <=1.15.3), org.apache.nifi:nifi-headless-server (>=1.13.0 <=1.13.2) +6 more potentially affected by CVE-2018-17194 via org.apache.nifi:nifi-framework-cluster (>=1.0.0 <=1.7.1)

org.apache.nifi:nifi-framework-cluster MAVEN version =1.0.0, =1.0.0, =1.13.0, =1.13.0, =1.0.0, =1.17.0, =1.13.0, =1.11.0, =1.0.0, =1.15.3 Source cves: CVE-2018-17194 Source advisory: OSV:GHSA-43FP-VWWG-QGV6...

CVE-2018-17194

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

CVE-2018-17194

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

CVE-2018-17194

Apache NiFi vulnerability CVE-2018-17194 arises because, during replication of client requests across cluster nodes, the Content-Length value was forwarded. For DELETE requests, the body was ignored; however, if the initial request carried a non-zero Content-Length, receiving nodes would wait for...