Inadequate Encryption Strength in Apache NiFi

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-9491 · ADVISORY
• apache/nifi commit 441781c · WEB
• apache/nifi · PACKAGE
• lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718@%3Ccommits.nifi.apache.org%3E · WEB
• lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf@%3Ccommits.nifi.apache.org%3E · WEB
• nifi.apache.org/security · WEB
• lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718%40%3Ccommits.nifi.apache.org%3E
• lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf%40%3Ccommits.nifi.apache.org%3E

org.apache.nifi:nifi のその他の脆弱性

• CVE-2022-33140高 8.8The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments f…
• CVE-2022-29265高 7.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard…
• CVE-2021-44145中 6.5In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included maliciou…
• CVE-2020-9487高 7.5In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a req…
• CVE-2020-13940中 5.5In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trust…