Описание
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Ссылки
- Issue TrackingVendor Advisory
- Mailing ListVendor Advisory
- Mailing ListPatchVendor Advisory
- Issue TrackingVendor Advisory
- Mailing ListVendor Advisory
- Mailing ListPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 1.4.0 (включая) до 1.10.1 (включая)
cpe:2.3:a:apache:flume:*:*:*:*:*:*:*:*
EPSS
Процентиль: 83%
0.01883
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-20
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
EPSS
Процентиль: 83%
0.01883
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-20