Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.nifi/nifi@0.0.2

Type maven

Namespace org.apache.nifi

Name nifi

Version 0.0.2

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 0.7.2

Latest_non_vulnerable_version 1.24.0

Affected_by_vulnerabilities

url VCID-mm3u-4acx-e3hj

vulnerability_id VCID-mm3u-4acx-e3hj

summary

Apache NiFi Code Injection vulnerability
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

references

reference_url	http://seclists.org/fulldisclosure/2023/Jul/43
reference_id
reference_type
scores
url	http://seclists.org/fulldisclosure/2023/Jul/43

reference_url	https://github.com/apache/nifi
reference_id
reference_type
scores
url	https://github.com/apache/nifi

reference_url	https://github.com/apache/nifi/commit/532578799c
reference_id
reference_type
scores
url	https://github.com/apache/nifi/commit/532578799c

reference_url	https://issues.apache.org/jira/browse/NIFI-11744
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/NIFI-11744

reference_url	https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof
reference_id
reference_type
scores
url	https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof

reference_url	https://nifi.apache.org/security.html#CVE-2023-36542
reference_id
reference_type
scores
url	https://nifi.apache.org/security.html#CVE-2023-36542

reference_url	http://www.openwall.com/lists/oss-security/2023/07/29/1
reference_id
reference_type
scores
url	http://www.openwall.com/lists/oss-security/2023/07/29/1

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-36542
reference_id	CVE-2023-36542
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-36542

reference_url	https://github.com/advisories/GHSA-r969-8v3h-23v9
reference_id	GHSA-r969-8v3h-23v9
reference_type
scores
url	https://github.com/advisories/GHSA-r969-8v3h-23v9

fixed_packages

url	pkg:maven/org.apache.nifi/nifi@1.23.0
purl	pkg:maven/org.apache.nifi/nifi@1.23.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.23.0

aliases CVE-2023-36542, GHSA-r969-8v3h-23v9

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mm3u-4acx-e3hj

url VCID-uwnc-5qk4-eqgw

vulnerability_id VCID-uwnc-5qk4-eqgw

summary

Apache NiFi vulnerable to Code Injection
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

references

reference_url	https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468
reference_id
reference_type
scores
url	https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468

reference_url	https://github.com/apache/nifi
reference_id
reference_type
scores
url	https://github.com/apache/nifi

reference_url	https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361
reference_id
reference_type
scores
url	https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361

reference_url	https://github.com/apache/nifi/pull/7349
reference_id
reference_type
scores
url	https://github.com/apache/nifi/pull/7349

reference_url	https://issues.apache.org/jira/browse/NIFI-11653
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/NIFI-11653

reference_url	https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8
reference_id
reference_type
scores
url	https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8

reference_url	https://nifi.apache.org/security.html#CVE-2023-34468
reference_id
reference_type
scores
url	https://nifi.apache.org/security.html#CVE-2023-34468

reference_url	https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation
reference_id
reference_type
scores
url	https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation

reference_url	http://www.openwall.com/lists/oss-security/2023/06/12/3
reference_id
reference_type
scores
url	http://www.openwall.com/lists/oss-security/2023/06/12/3

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-34468
reference_id	CVE-2023-34468
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-34468

reference_url	https://github.com/advisories/GHSA-xm2m-2q6h-22jw
reference_id	GHSA-xm2m-2q6h-22jw
reference_type
scores
url	https://github.com/advisories/GHSA-xm2m-2q6h-22jw

fixed_packages

url pkg:maven/org.apache.nifi/nifi@1.22.0

purl pkg:maven/org.apache.nifi/nifi@1.22.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mm3u-4acx-e3hj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.22.0

aliases CVE-2023-34468, GHSA-xm2m-2q6h-22jw

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uwnc-5qk4-eqgw

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@0.0.2

Package Instance