[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 23 Jan 2018 11:39:32 -0800
From: Andy LoPresto <alopresto@...che.org>
To: security@...i.apache.org
Cc: dev@...i.apache.org,
users@...i.apache.org,
oss-security@...ts.openwall.com
Subject: [ANNOUNCE] CVE fixes in Apache NiFi 1.5.0
The Apache NiFi PMC would like to announce the following CVE discoveries and resolutions in Apache NiFi 1.5.0, released January 12, 2018. NiFi is an easy to use, powerful, and reliable system to process and distribute data. It supports powerful and scalable directed graphs of data routing, transformation, and system mediation logic. For more information, see https://nifi.apache.org/security.html <https://nifi.apache.org/security.html>.
CVE-2017-12632 <https://nifi.apache.org/security.html#CVE-2017-12632>: Apache NiFi host header poisoning issue
Severity: Medium
Versions Affected:
Apache NiFi 0.1.0 - 1.4.0
Description: A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server.
Mitigation: The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Credit: This issue was discovered by Mike Cole.
Released: January 12, 2018
CVE-2017-15697 <https://nifi.apache.org/security.html#CVE-2017-15697>: Apache NiFi XSS issue in context path handling
Severity: Medium
Versions Affected:
Apache NiFi 1.0.0 - 1.4.0
Description: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution.
Mitigation: The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Credit: This issue was discovered by Andy LoPresto.
Released: January 12, 2018
Andy LoPresto
alopresto@...che.org
alopresto.apache@...il.com
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69
Content of type "text/html" skipped
Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
