Date: Mon, 10 Feb 2020 13:49:30 -0800 From: Andy LoPresto <alopresto@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs The https://nifi.apache.org/security.html <https://nifi.apache.org/security.html> page has been updated with 1 vulnerability discovered in previous NiFi versions which has been resolved in release 1.11.1. The severity of this issue was determined to be ‘important'. Questions about this vulnerability can be directed to security@...i.apache.org <mailto:security@...i.apache.org>. CVE-2020-1942: Apache NiFi information disclosure in logs Severity: Important Versions Affected: Apache NiFi 0.0.1 - 1.11.0 Description: The flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext. Mitigation: Implemented Argon2 secure hashing to provide a deterministic loggable value which does not reveal the sensitive value. Users running any previous NiFi release should upgrade to the latest release. Released: February 4, 2020 If you identify new security issues within the NiFi 1.11.1 release, please forward your report to security@...i.apache.org <mailto:security@...i.apache.org> and do not disclose the issue publicly. The security vulnerability reporting and disclosure process can be found here: https://www.apache.org/security/committers.html <https://www.apache.org/security/committers.html>. Andy LoPresto alopresto@...che.org alopresto.apache@...il.com PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.