www-announce mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Andy LoPresto <alopre...@apache.org>
Subject [ANNOUNCE] Apache NiFi CVE-2017-12623
Date Mon, 09 Oct 2017 23:02:37 GMT
Apache NiFi PMC would like to announce the discovery and resolution of CVE-2017-12623. This
issue has been resolved and a new version of the Apache NiFi project was released in accordance
with the Apache Release Process.

Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data.
It supports powerful and scalable directed graphs of data routing, transformation, and system
mediation logic.

Fixed in Apache NiFi 1.4.0 (Released: October 2, 2017)

CVE-2017-12623: Apache NiFi XXE issue when loading template

Severity: Medium

Versions Affected:

Apache NiFi 1.0.0 - 1.3.0

Description: An authorized user could upload a template which contained malicious code and
accessed sensitive files via an XML External Entity (XXE) attack.

Mitigation: The fix to properly handle XML External Entities was applied on the Apache NiFi
1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Credit: This issue was discovered by PaweĊ‚ Gocyla.

For more information: https://nifi.apache.org/security.html

Andy LoPresto
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4  BACE 3C6E F65B 2F7D EF69

View raw message