github_osv/GHSA-9w4g-fp9h-3q2v
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.
gitlab/maven/org.apache.flume.flume-ng-sources/flume-jms-source/CVE-2022-42468
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Apache Flume versions 1.4.0 through 1.10.1 is vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
gitlab/maven/org.apache.flume/flume-parent/CVE-2022-42468
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Apache Flume versions 1.4.0 through 1.10.1 is vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
gitlab/maven/org.mongodb.mongo-hadoop/flume/CVE-2022-42468
Improper Input Validation
Apache Flume versions 1.4.0 through 1.10.1 is vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.