CVE-2023-34212
published 2023-06-12CVE-2023-34212: The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
2.35%
81.7th percentile
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | nifi | — | — |
| apache | nifi | 1.8.0 – 1.21.0 | — |
| apache_software_foundation | apache_nifi | 1.8.0 – 1.21.0 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_apache6.5
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache NiFi vulnerable to Deserialization of Untrusted Data
ghsa·2023-06-12
CVE-2023-34212 [MEDIUM] CWE-502 Apache NiFi vulnerable to Deserialization of Untrusted Data
Apache NiFi vulnerable to Deserialization of Untrusted Data
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
OSV
Apache NiFi vulnerable to Deserialization of Untrusted Data
osv·2023-06-12
CVE-2023-34212 [MEDIUM] Apache NiFi vulnerable to Deserialization of Untrusted Data
Apache NiFi vulnerable to Deserialization of Untrusted Data
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.
The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Apache
Apache nifi: CVE-2023-34212
vendor_apache·CVSS 6.5
CVE-2023-34212 Apache nifi: CVE-2023-34212
Apache nifi: CVE-2023-34212
Title: Potential Deserialization of Untrusted Data with JNDI in JMS Components Published: 2023-06-12 Severity: Medium Products: Apache NiFi Affected Versions: 1.8.0 to 1.21.0 Fixed Versions: 1.22.0 Reporter: Veraxy00 of Qianxin TI Center and Matei 'Mal' Badanoiu References CVE Record: CVE-2023-34212 NVD Record: CVE-2023-34212 Apache Jira Issue: NIFI-11614 GitHub Pull Request: 7313 The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/06/12/2https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5https://nifi.apache.org/security.html#CVE-2023-34212http://www.openwall.com/lists/oss-security/2023/06/12/2https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5https://nifi.apache.org/security.html#CVE-2023-34212
2023-06-12
Published