oss-security - [CVE-2020-1960] Apache Flink JMX information disclosure vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 13 May 2020 20:08:48 +0200
From: Chesnay Schepler <chesnay@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2020-1960] Apache Flink JMX information disclosure vulnerability

CVE-2020-1960: Apache Flink JMX information disclosure vulnerability

Severity: Medium
(CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H)

Vendor:
The Apache Software Foundation

Versions Affected:
Flink 1.1.0 to 1.1.5
Flink 1.2.0 to 1.2.1
Flink 1.3.0 to 1.3.3
Flink 1.4.0 to 1.4.2
Flink 1.5.0 to 1.5.6
Flink 1.6.0 to 1.6.4
Flink 1.7.0 to 1.7.2
Flink 1.8.0 to 1.8.3
Flink 1.9.0 to 1.9.2
Flink 1.10.0

Description:
When running a process with an enabled JMXReporter, with a port 
configured via metrics.reporter.<reporter_name>.port, an attacker with 
local access to the machine and JMX port can execute a man-in-the-middle 
attack using a specially crafted request to rebind the JMXRMI registry 
to one under the attacker's control. This compromises any connection 
established to the process via JMX, allowing extraction of credentials 
and any other transferred data.

Mitigation:
All users should either
- remove the port parameter from the reporter configuration,
- upgrade to 1.9.3 or 1.10.1,
- obtain the source for their release from the Flink website or git and 
apply the patch corresponding to their version from the list below:

1.1: a61b5d2b362d11e7b9deeb2334d275325574bd7b
1.2: d2a051267ffbeef5c1fd981860fb7032d9ac8a60
1.3: 4f06bb75cd726096af43587ca4fb182b2e4bae2e
1.4: 12787eceb49c566b28aa876fc2892d21a0ec3d79
1.5: f9b4e0dea71abbcd6463c757577c70c45b3e6bbf
1.6: b8647b1ca019003ae939b7494bba4e54de167b6f
1.7: 5e0b7970a9aea74aba4ebffaa75c37e960799b93
1.8: 0e8e8062bcc159e9ed2a0d4a0a61db4efcb01f2f
1.9: 58b58f4b16a2e25c95b465377d43a51ad8ef3f6a
1.10: 804ae70024bf8be7c0c7093d02addb080c318662

Credit:
The issue was discovered in Flink by Jonathan Gallimore, Tomitribe and 
Colm O hEigeartaigh, Talend.
The underlying vulnerability pattern was discovered by An Trinh and 
published at Blackhat.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.