CVE-2022-34916
published 2022-08-21CVE-2022-34916: Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.31%
81.4th percentile
Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | flume | >= 1.4.0 < 1.10.1 | 1.10.1 |
| apache_software_foundation | apache_flume | >= flume-jms-source < 1.11.0 | 1.11.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable component is Apache Flume JMS Source configured with a JNDI LDAP data source URI; monitor for LDAP-based JNDI URIs in Flume JMS Source configurations ↗
- →Alert on JNDI LDAP protocol usage within Flume JMS Source configurations; the fix restricts JNDI to the java protocol only, so presence of ldap:// or other non-java JNDI URIs in Flume config is a strong indicator of exploitation attempt ↗
- ·Exploitation requires the Flume instance to be configured with a JMS Source using a JNDI LDAP data source URI AND the attacker must control the target LDAP server; not all Flume deployments are affected ↗
- ·Affected version range is Apache Flume 1.4.0 through 1.10.0 only; several Red Hat packages (A-MQ Clients 2, Red Hat Data Grid 8, Red Hat JBoss Data Grid 7, Red Hat JBoss EAP 7, Red Hat JBoss EAP Expansion Pack, streams for Apache Kafka) are confirmed not affected ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
flume: JNDI Injection in JMSMessageConsumer
vendor_redhat·2022-08-20·CVSS 9.8
CVE-2022-34916 [CRITICAL] CWE-20 flume: JNDI Injection in JMSMessageConsumer
flume: JNDI Injection in JMSMessageConsumer
Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Package: flume (A-MQ Clients 2) - Not affected
Package: flume (Red Hat Data Grid 8) - Not affected
Package: flume (Red Hat JBoss Data Grid 7) - Not affected
Package: flume-ng-core (Red Hat JBoss Enterprise Application Platform 7) - Not affected
Package: flume-ng-core (Red Hat JBoss Enterprise Application Platform Expansion Pack) - Not affected
Package: flume (streams for Apache Kafka) - Not affected
GHSA
Remote code execution in Apache Flume
ghsa·2022-08-22
CVE-2022-34916 [CRITICAL] CWE-20 Remote code execution in Apache Flume
Remote code execution in Apache Flume
Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
OSV
Remote code execution in Apache Flume
osv·2022-08-22
CVE-2022-34916 [CRITICAL] Remote code execution in Apache Flume
Remote code execution in Apache Flume
Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-21
Published