Apache NiFi vulnerable to Deserialization of Untrusted Data
Moderate severity
GitHub Reviewed
Published
Jun 12, 2023
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Package
Affected versions
>= 1.8.0, < 1.22.0
Patched versions
1.22.0
Description
Published by the National Vulnerability Database
Jun 12, 2023
Published to the GitHub Advisory Database
Jun 12, 2023
Reviewed
Jun 12, 2023
Last updated
Nov 10, 2023
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
References