PT-2020-20698 · Apache · Apache Nifi

Published 2020-10-01 · Updated 2025-09-12 · CVE-2020-9491

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.2.0 through 1.11.4

Description The issue concerns the support of outdated TLS versions in intracluster communication. Specifically, cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1, despite the NiFi UI and API mandating TLS v1.2.

Recommendations For Apache NiFi versions 1.2.0 through 1.11.4, consider updating the configuration to only support TLS v1.2 or later for intracluster communication to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BIT-NIFI-2020-9491

CVE-2020-9491

GHSA-RFMP-JVR7-HX78

Affected Products

Apache Nifi

References · 11

• https://osv.dev/vulnerability/BIT-nifi-2020-9491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9491 · Security Note
• https://nifi.apache.org/security#CVE-2020-9491 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9491 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rfmp-jvr7-hx78 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/441781cec50f77d9f1e65093f55bbd614b8c5ec6 · Note
• https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718%40%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf%40%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf@%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718@%3Ccommits.nifi.apache.org%3E · Note