Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Xalan-Java is an XSLT processor for transforming XML documents into HTML,
text, or other XML document types. It implements XSL Transformations (XSLT)
Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from
the command line, in an applet or a servlet, or as a module in other program.
Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-poi-bundle/nifi-poi-nar/pom.xml
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Apache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
Thrift is a software framework for scalable cross-language services development.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
Thrift is a software framework for scalable cross-language services development.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Apache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
The Netty project is an effort to provide an asynchronous event-driven
network application framework and tools for rapid development of
maintainable high performance and high scalability protocol servers and
clients. In other words, Netty is a NIO client server framework which
enables quick and easy development of network applications such as protocol
servers and clients. It greatly simplifies and streamlines network
programming such as TCP and UDP socket server.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - nifi-flume-processors-1.15.0-SNAPSHOT.jar
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-20444
### Vulnerable Library - netty-3.5.12.Final.jarThe Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.
Library home page: http://netty.io/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsHttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Publish Date: 2020-01-29
URL: CVE-2019-20444
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444
Release Date: 2020-01-29
Fix Resolution: io.netty:netty-all:4.1.44.Final
CVE-2020-13936
### Vulnerable Library - velocity-1.7.jarApache Velocity is a general purpose template engine.
Library home page: http://www.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - avro-ipc-1.7.4.jar - :x: **velocity-1.7.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAn attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Publish Date: 2021-03-10
URL: CVE-2020-13936
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-03-10
Fix Resolution: org.apache.velocity:velocity-engine-core:2.3
CVE-2022-34169
### Vulnerable Library - xalan-2.7.2.jarXalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements XSL Transformations (XSLT) Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from the command line, in an applet or a servlet, or as a module in other program.
Library home page: http://www.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-poi-bundle/nifi-poi-nar/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-hive-sink-1.6.0.jar - :x: **xalan-2.7.2.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Publish Date: 2022-07-19
URL: CVE-2022-34169
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-9339-86wc-4qgf
Release Date: 2022-07-19
Fix Resolution: xalan:xalan:2.7.3
CVE-2019-0231
### Vulnerable Library - mina-core-2.0.4.jarApache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
Library home page: http://mina.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-core-1.6.0.jar - :x: **mina-core-2.0.4.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsHandling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
Publish Date: 2019-10-01
URL: CVE-2019-0231
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-5h29-qq92-wj7f
Release Date: 2019-09-27
Fix Resolution: org.apache.mina:mina-core:2.0.21,2.1.1
CVE-2019-0205
### Vulnerable Library - libthrift-0.9.0.jarThrift is a software framework for scalable cross-language services development.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **libthrift-0.9.0.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
Publish Date: 2019-10-28
URL: CVE-2019-0205
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205
Release Date: 2019-10-28
Fix Resolution: org.apache.thrift:libthrift:0.13.0
CVE-2018-1320
### Vulnerable Library - libthrift-0.9.0.jarThrift is a software framework for scalable cross-language services development.
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **libthrift-0.9.0.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsApache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Publish Date: 2019-01-07
URL: CVE-2018-1320
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1320
Release Date: 2019-01-07
Fix Resolution: 0.12.0
CVE-2015-2156
### Vulnerable Library - netty-3.5.12.Final.jarThe Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.
Library home page: http://netty.io/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsNetty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Publish Date: 2017-10-18
URL: CVE-2015-2156
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2156
Release Date: 2017-10-18
Fix Resolution: io.netty:netty:3.9.8.Final,io.netty:netty:3.10.3.Final,io.netty:netty-all:4.0.28.Final,io.netty:netty-codec-http:4.0.28.Final,io.netty:netty-codec-http:4.1.0.Beta5
CVE-2014-3488
### Vulnerable Library - netty-3.5.12.Final.jarThe Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.
Library home page: http://netty.io/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Publish Date: 2014-07-31
URL: CVE-2014-3488
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488
Release Date: 2014-07-31
Fix Resolution: 3.9.2.Final
CVE-2021-41973
### Vulnerable Library - mina-core-2.0.4.jarApache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
Library home page: http://mina.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-core-1.6.0.jar - :x: **mina-core-2.0.4.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Publish Date: 2021-11-01
URL: CVE-2021-41973
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-6mcm-j9cj-3vc3
Release Date: 2021-11-01
Fix Resolution: org.apache.mina:mina-core:2.0.22,2.1.5
CVE-2014-0193
### Vulnerable Library - netty-3.5.12.Final.jarThe Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.
Library home page: http://netty.io/
Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml
Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsWebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
Publish Date: 2014-05-06
URL: CVE-2014-0193
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0193
Release Date: 2014-05-06
Fix Resolution: io.netty:netty-all:4.0.19.Final,io.netty:netty-codec-http:4.0.19.Final,io.netty:netty:3.6.9.Final,io.netty:netty:3.7.1.Final,io.netty:netty:3.8.2.Final,io.netty:netty:3.9.1.Final