CVE-2018-17194

published 2018-12-19

CVE-2018-17194: When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request…

high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	nifi	—	—
apache	nifi	1.0.0 – 1.7.1	—
apache_software_foundation	apache_nifi	—	—

CWE-20