GitHub Advisoryadvisory · Maven

GHSA-rfmp-jvr7-hx78 Inadequate Encryption Strength in Apache NiFi

HIGH Published 2022-01-06 Modified 2022-04-29 Official page ↗
Aliases
CVE-2020-9491
Ecosystem
Maven
Packages
org.apache.nifi:nifi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-327
Reviewed
2021-03-29

Affected packages

• Maven org.apache.nifi:nifi: >= 1.2.0, < 1.12.0-RC1 → fixed in 1.12.0-RC1

Description

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

Related

Alias · CVE (1)

  • CVE-2020-9491 In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References