search

snowdensb / nifi

Apache NiFi
https://nifi.apache.org/
Apache License 2.0
0 stars 0 forks source link

nifi-flume-processors-1.15.0-SNAPSHOT.jar: 10 vulnerabilities (highest severity is: 9.1) - autoclosed #572

Closed mend-for-github-com[bot] closed 1 week ago

mend-for-github-com[bot] commented 1 month ago
Vulnerable Library - nifi-flume-processors-1.15.0-SNAPSHOT.jar

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (nifi-flume-processors version) Remediation Possible** Reachability
CVE-2019-20444 Critical 9.1 netty-3.5.12.Final.jar Transitive N/A* ❌
CVE-2020-13936 High 8.8 velocity-1.7.jar Transitive N/A* ❌
CVE-2022-34169 High 7.5 xalan-2.7.2.jar Transitive N/A* ❌
CVE-2019-0231 High 7.5 mina-core-2.0.4.jar Transitive N/A* ❌
CVE-2019-0205 High 7.5 libthrift-0.9.0.jar Transitive N/A* ❌
CVE-2018-1320 High 7.5 libthrift-0.9.0.jar Transitive N/A* ❌
CVE-2015-2156 High 7.5 netty-3.5.12.Final.jar Transitive N/A* ❌
CVE-2014-3488 High 7.5 netty-3.5.12.Final.jar Transitive N/A* ❌
CVE-2021-41973 Medium 6.5 mina-core-2.0.4.jar Transitive N/A* ❌
CVE-2014-0193 Medium 5.3 netty-3.5.12.Final.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-20444 ### Vulnerable Library - netty-3.5.12.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Publish Date: 2020-01-29

URL: CVE-2019-20444

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444

Release Date: 2020-01-29

Fix Resolution: io.netty:netty-all:4.1.44.Final

CVE-2020-13936 ### Vulnerable Library - velocity-1.7.jar

Apache Velocity is a general purpose template engine.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - avro-ipc-1.7.4.jar - :x: **velocity-1.7.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Publish Date: 2021-03-10

URL: CVE-2020-13936

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-03-10

Fix Resolution: org.apache.velocity:velocity-engine-core:2.3

CVE-2022-34169 ### Vulnerable Library - xalan-2.7.2.jar

Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It implements XSL Transformations (XSLT) Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from the command line, in an applet or a servlet, or as a module in other program.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-poi-bundle/nifi-poi-nar/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-hive-sink-1.6.0.jar - :x: **xalan-2.7.2.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Publish Date: 2022-07-19

URL: CVE-2022-34169

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-9339-86wc-4qgf

Release Date: 2022-07-19

Fix Resolution: xalan:xalan:2.7.3

CVE-2019-0231 ### Vulnerable Library - mina-core-2.0.4.jar

Apache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.

Library home page: http://mina.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-core-1.6.0.jar - :x: **mina-core-2.0.4.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

Publish Date: 2019-10-01

URL: CVE-2019-0231

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-5h29-qq92-wj7f

Release Date: 2019-09-27

Fix Resolution: org.apache.mina:mina-core:2.0.21,2.1.1

CVE-2019-0205 ### Vulnerable Library - libthrift-0.9.0.jar

Thrift is a software framework for scalable cross-language services development.

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **libthrift-0.9.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

Publish Date: 2019-10-28

URL: CVE-2019-0205

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205

Release Date: 2019-10-28

Fix Resolution: org.apache.thrift:libthrift:0.13.0

CVE-2018-1320 ### Vulnerable Library - libthrift-0.9.0.jar

Thrift is a software framework for scalable cross-language services development.

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **libthrift-0.9.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Publish Date: 2019-01-07

URL: CVE-2018-1320

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1320

Release Date: 2019-01-07

Fix Resolution: 0.12.0

CVE-2015-2156 ### Vulnerable Library - netty-3.5.12.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Publish Date: 2017-10-18

URL: CVE-2015-2156

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2156

Release Date: 2017-10-18

Fix Resolution: io.netty:netty:3.9.8.Final,io.netty:netty:3.10.3.Final,io.netty:netty-all:4.0.28.Final,io.netty:netty-codec-http:4.0.28.Final,io.netty:netty-codec-http:4.1.0.Beta5

CVE-2014-3488 ### Vulnerable Library - netty-3.5.12.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

Publish Date: 2014-07-31

URL: CVE-2014-3488

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488

Release Date: 2014-07-31

Fix Resolution: 3.9.2.Final

CVE-2021-41973 ### Vulnerable Library - mina-core-2.0.4.jar

Apache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.

Library home page: http://mina.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-core-1.6.0.jar - :x: **mina-core-2.0.4.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Publish Date: 2021-11-01

URL: CVE-2021-41973

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-6mcm-j9cj-3vc3

Release Date: 2021-11-01

Fix Resolution: org.apache.mina:mina-core:2.0.22,2.1.5

CVE-2014-0193 ### Vulnerable Library - netty-3.5.12.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to dependency file: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-flume-bundle/nifi-flume-nar/pom.xml,/nifi-nar-bundles/nifi-flume-bundle/nifi-flume-processors/pom.xml

Dependency Hierarchy: - nifi-flume-processors-1.15.0-SNAPSHOT.jar (Root Library) - flume-ng-sdk-1.6.0.jar - :x: **netty-3.5.12.Final.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

Publish Date: 2014-05-06

URL: CVE-2014-0193

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0193

Release Date: 2014-05-06

Fix Resolution: io.netty:netty-all:4.0.19.Final,io.netty:netty-codec-http:4.0.19.Final,io.netty:netty:3.6.9.Final,io.netty:netty:3.7.1.Final,io.netty:netty:3.8.2.Final,io.netty:netty:3.9.1.Final

mend-for-github-com[bot] commented 1 week ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.