[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b9120cdb-8cca-699e-bcc2-f4e173b1f2bc@apache.org>
Date: Tue, 24 Aug 2021 08:32:18 +0000
From: Arpad Boda <aboda@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-33191: Apache NiFi - MiNiFi C++: MiNiFi CPP arbitrary
script execution is possible on the agent's host machine through the c2
protocol
Description:
>From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary.
This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update"
command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
