GitHub Advisoryadvisory · Maven

GHSA-9w4g-fp9h-3q2v Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

CRITICAL Published 2022-10-26 Modified 2023-07-28 Official page ↗
Aliases
CVE-2022-42468
Ecosystem
Maven
Packages
org.apache.flume.flume-ng-sources:flume-jms-source
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-502
Reviewed
2022-10-27

Affected packages

• Maven org.apache.flume.flume-ng-sources:flume-jms-source: < 1.11.0 → fixed in 1.11.0

Description

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.

Related

Alias · CVE (1)

  • CVE-2022-42468 Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References