~ / search / GHSA-9w4g-fp9h-3q2v

GHSA-9w4g-fp9h-3q2v

Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-42468

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.flume.flume-ng-sources:flume-jms-source < 1.11.0 1.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.

References

External links from the advisory. They lead to third-party sites.