Denial of service via deserialization attack in nifi

MEDIO 5.0CVE-2017-15703 · GHSA-xwx6-vmj4-5rv8 · Published 25/01/2018 · updated 17/06/2026

In breve

CVE-2017-15703 è una vulnerabilità MEDIO (CVSS 5.0) che riguarda org.apache.nifi:nifi-framework-cluster-protocol, nifi (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.86%, superiore al 58.6% delle vulnerabilità.
Correzione: aggiornare a 1.5.0 o successiva.

Package	Affected versions	Patched versions
org.apache.nifi:nifi-framework-cluster-protocol Maven	`< 1.5.0`	`1.5.0`
nifi apache	`≥ 1.0.0, ≤ 1.4.0`	No fix yet

Description

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.

NVD description

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

References

apache/nifi commit 9e2c7be · WEB
nifi.apache.org/security.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free