Matei Mal Badanoiu

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 1.21.0 through 1.23.0 **Description** The issue is related to insufficient comparison in the Apache NiFi data processing platform. An authenticated and authorized user can bypass connection URL validation using custom input formatting, potentially allowing a remote attacker to gain unauthorized access to protected information. The vulnerability affects several Processors and Controller Services that support JDBC and JNDI JMS access. **Recommendations** For Apache NiFi versions 1.21.0 through 1.23.0, upgrade to Apache NiFi 1.23.1 to enhance connection URL validation and introduce validation for additional related properties.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 1.8.0 through 1.21.0 **Description** The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. **Recommendations** Upgrade to version 1.22.0 or later, which fixes this issue.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 0.0.2 through 1.21.0 **Description** The issue in Apache NiFi is related to the DBCPConnectionPool and HikariCPConnectionPool Controller Services, which allow an authenticated and authorized user to configure a Database URL with the H2 driver, enabling custom code execution. This can be exploited by a remote attacker to execute arbitrary code. Thousands of organizations are impacted by this issue. The resolution involves validating the Database URL and rejecting H2 JDBC locations. **Recommendations** For Apache NiFi versions 0.0.2 through 1.21.0, upgrade to version 1.22.0 or later, which fixes this issue. As a temporary workaround, consider restricting the use of the H2 driver in the Database URL configuration to minimize the risk of exploitation.

**Nome do software vulnerável e versões afetadas: ansible-tower (versões afetadas não especificadas) Descrição: Foi identificada uma falha na instalação padrão do ansible-tower, permitindo que um invasor eleve seus privilégios de um usuário com privilégios limitados para o usuário awx a partir de fora do ambiente isolado, por meio de uma fuga do isolamento de tarefas. A principal ameaça decorrente desse problema é à confidencialidade e integridade dos dados, bem como à disponibilidade do sistema. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.