PT-2023-6523 · Apache · Apache Nifi Minifi C++

Ferenc Gerlits · Publicado 2023-09-03 · Atualizado 2023-09-08 · CVE-2023-41180

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi MiNiFi C++ versions 0.13 through 0.14

Description The issue is related to incorrect certificate validation in the InvokeHTTP component, allowing an intermediary to present a forged certificate during TLS handshake negotiation. This occurs because the Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default when using HTTPS.

Recommendations For Apache NiFi MiNiFi C++ versions 0.13.0 or 0.14.0, set the Disable Peer Verification property of InvokeHTTP to true. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2023-07270

CVE-2023-41180

Produtos afetados

Apache Nifi Minifi C++

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-41180 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1698369768288399535 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-41180 · Nota de Segurança
• https://t.me/cibsecurity/69710 · Publicação no Telegram
• https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1698402689107873995 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-07270 · Nota de Segurança