Lucene search

GoogleOSV:CVE-2023-41180

HistorySep 03, 2023 - 4:15 p.m.

CVE-2023-41180

2023-09-0316:15:10

Google

osv.dev

apache nifi

minifi c++

certificate validation

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.3%

JSON

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS.

Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.

CPENameOperatorVersion
nifi-minifi-cppeqminifi-cpp-0.13.0-RC2
nifi-minifi-cppeqminifi-cpp-0.13.0-RC1
nifi-minifi-cppeqminifi-cpp-0.14.0-RC1
nifi-minifi-cppeqrel/minifi-cpp-0.14.0
nifi-minifi-cppeqrel/minifi-cpp-0.13.0

Name	Operator	Version
nifi-minifi-cpp	eq	minifi-cpp-0.13.0-RC2
nifi-minifi-cpp	eq	minifi-cpp-0.13.0-RC1
nifi-minifi-cpp	eq	minifi-cpp-0.14.0-RC1
nifi-minifi-cpp	eq	rel/minifi-cpp-0.14.0
nifi-minifi-cpp	eq	rel/minifi-cpp-0.13.0

References

lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.3%

JSON

Related for OSV:CVE-2023-41180