Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
References
| Link | Resource |
|---|---|
| https://issues.apache.org/jira/browse/FLUME-3437 | Issue Tracking Vendor Advisory |
| https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz | Mailing List Vendor Advisory |
| https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78 | Mailing List Patch Vendor Advisory |
Configurations
History
28 Oct 2022, 17:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:flume:*:*:*:*:*:*:*:* | |
| References | (CONFIRM) https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78 - Mailing List, Patch, Vendor Advisory | |
| References | (CONFIRM) https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz - Mailing List, Vendor Advisory | |
| References | (CONFIRM) https://issues.apache.org/jira/browse/FLUME-3437 - Issue Tracking, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
26 Oct 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-26 16:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-42468
Mitre link : CVE-2022-42468
CVE.ORG link : CVE-2022-42468
JSON object : View
Products Affected
apache
- flume