PT-2022-3058 · Apache · Apache Flume

Published 2022-06-14 · Updated 2022-06-27 · CVE-2022-25167

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Flume versions 1.4.0 through 1.9.0

Description The issue is related to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI, and an attacker has control of the target LDAP server. This can allow an attacker to execute arbitrary code. The problem is also described as being related to the restoration of untrusted data in memory.

Recommendations For Apache Flume versions 1.4.0 through 1.9.0, limit JNDI to allow only the use of the java protocol or no protocol to fix the issue.

Fix

Special Elements Injection

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-74

CWE-502

CWE-20

Related Identifiers

BDU:2022-03727

CVE-2022-25167

GHSA-X5M7-RWFX-W7QM

Affected Products

Apache Flume

References · 10

• https://issues.apache.org/jira/browse/FLUME-3416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25167 · Security Note
• https://bdu.fstec.ru/vul/2022-03727 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25167 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5m7-rwfx-w7qm · Vendor Advisory
• https://github.com/apache/flume · Note
• https://github.com/apache/flume/commit/dafb26ccb172141c6e14e95447e1b6ae38e9a7d0 · Note
• https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg · Note
• https://t.me/cvenotify/31574 · Telegram Post
• http://openwall.com/lists/oss-security/2022/06/14/1 · Note