Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution RCE attack when a configuration uses a JMS Source with an unsafe...