CVE-2023-34212

Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

EPSS 2.4%CWE-502

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 2.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

12 jun 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Produtos afetados

Apache Software Foundation · Apache NiFi

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 https://nifi.apache.org/security.html#CVE-2023-34212 http://www.openwall.com/lists/oss-security/2023/06/12/2