| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.flume.flume-ng-sources:flume-jms-source | < 1.11.0 | 1.11.0 |
| flume | ≥ 1.4.0, ≤ 1.10.1 |
Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free