PT-2018-5978 · Apache · Apache Nifi

Mike Cole · Publicado 2018-01-25 · Atualizado 2019-10-25 · CVE-2017-15703

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.4.0 Apache NiFi versions prior to 1.5.0-RC1

Description: The issue allows any authenticated user to upload a template containing malicious code, potentially causing a denial of service via Java deserialization attack. Additionally, an attacker can perform XXE attacks through JAXB.

Recommendations: For Apache NiFi versions prior to 1.4.0, upgrade to Apache NiFi 1.4.0 or later to properly handle Java deserialization and mitigate the risk of denial of service attacks. For Apache NiFi versions prior to 1.5.0-RC1, upgrade to Apache NiFi 1.5.0-RC1 or later to prevent XXE attacks through JAXB.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-15703

GHSA-XWX6-VMJ4-5RV8

Produtos afetados

Apache Nifi

Referências · 5

• https://github.com/apache/nifi/commit/9e2c7be7d3c6a380c5f61074d9a5a690b617c3dc · Nota
• https://osv.dev/vulnerability/GHSA-xwx6-vmj4-5rv8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-15703 · Aviso do Fabricante
• https://nifi.apache.org/security.html#CVE-2017-15703 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15703 · Nota de Segurança