~ / search / GHSA-43fp-vwwg-qgv6

GHSA-43fp-vwwg-qgv6

Apache NiFi Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-17194

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.nifi:nifi-framework-cluster >= 1.0.0, < 1.8.0 1.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

References

External links from the advisory. They lead to third-party sites.