PT-2023-6523 · Apache · Apache Nifi Minifi C++

Ferenc Gerlits · Published 2023-09-03 · Updated 2023-09-08 · CVE-2023-41180

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi MiNiFi C++ versions 0.13 through 0.14

Description The issue is related to incorrect certificate validation in the InvokeHTTP component, allowing an intermediary to present a forged certificate during TLS handshake negotiation. This occurs because the Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default when using HTTPS.

Recommendations For Apache NiFi MiNiFi C++ versions 0.13.0 or 0.14.0, set the Disable Peer Verification property of InvokeHTTP to true. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-07270

CVE-2023-41180

Affected Products

Apache Nifi Minifi C++

References · 7

• https://osv.dev/vulnerability/CVE-2023-41180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41180 · Security Note
• https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07270 · Security Note
• https://twitter.com/CVEnew/status/1698369768288399535 · Twitter Post
• https://t.me/cibsecurity/69710 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1698402689107873995 · Twitter Post