GitHub Advisoryadvisory · Maven

GHSA-7q8g-gpfp-v8gx Insertion of Sensitive Information into Log File in Apache NiFi

HIGH Published 2022-01-06 Modified 2021-07-28 Official page ↗
Aliases
CVE-2020-1942
Ecosystem
Maven
Packages
org.apache.nifi:nifi-framework-core, org.apache.nifi:nifi-security-utils
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2021-03-29

Affected packages

• Maven org.apache.nifi:nifi-framework-core: >= 0.0.1, < 1.12.0-RC1 → fixed in 1.12.0-RC1 • Maven org.apache.nifi:nifi-security-utils: >= 0.0.1, < 1.12.0-RC1 → fixed in 1.12.0-RC1

Description

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.

Related

Alias · CVE (1)

  • CVE-2020-1942 In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References