oss-security - CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <CE6967F1-2CD4-4A6E-89CF-75B2FE817EAE@apache.org>
Date: Mon, 10 Feb 2020 13:49:30 -0800
From: Andy LoPresto <alopresto@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs

The https://nifi.apache.org/security.html <https://nifi.apache.org/security.html> page has been updated with 1 vulnerability discovered in previous NiFi versions which has been resolved in release 1.11.1. The severity of this issue was determined to be ‘important'. Questions about this vulnerability can be directed to security@...i.apache.org <mailto:security@...i.apache.org>.

CVE-2020-1942: Apache NiFi information disclosure in logs

Severity: Important

Versions Affected: Apache NiFi 0.0.1 - 1.11.0

Description: The flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.

Mitigation: Implemented Argon2 secure hashing to provide a deterministic loggable value which does not reveal the sensitive value. Users running any previous NiFi release should upgrade to the latest release.

Released: February 4, 2020

If you identify new security issues within the NiFi 1.11.1 release, please forward your report to security@...i.apache.org <mailto:security@...i.apache.org> and do not disclose the issue publicly. The security vulnerability reporting and disclosure process can be found here: https://www.apache.org/security/committers.html <https://www.apache.org/security/committers.html>.

Andy LoPresto
alopresto@...che.org
alopresto.apache@...il.com
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4  BACE 3C6E F65B 2F7D EF69

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.