CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

2023-06-1215:14:06

CWE-502

apache

www.cve.org

apache nifi

cve-2023-34212

deserialization

vulnerability

jndi

jms

components

authentication

0.002 Low

EPSS

Percentile

52.8%

JSON

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache NiFi",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.21.0",
        "status": "affected",
        "version": "1.8.0",
        "versionType": "semver"
      }
    ]
  }
]