GitHub Advisoryadvisory · Maven

GHSA-65wh-g8x8-gm2h Apache NiFi vulnerable to Deserialization of Untrusted Data

MEDIUM Published 2023-06-12 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-34212
Ecosystem
Maven
Packages
org.apache.nifi:nifi-jms-processors
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-502
Reviewed
2023-06-12

Affected packages

• Maven org.apache.nifi:nifi-jms-processors: >= 1.8.0, < 1.22.0 → fixed in 1.22.0

Description

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2023-34212 The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References