GHSA-g644-pr5v-vppf
Insertion of Sensitive Information into Log File in Apache NiFi Stateless
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.nifi:nifi-stateless | >= 1.10.0, < 1.12.0-RC1 | 1.12.0-RC1 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.
References
External links from the advisory. They lead to third-party sites.