~ / search / GHSA-rfmp-jvr7-hx78

GHSA-rfmp-jvr7-hx78

Inadequate Encryption Strength in Apache NiFi

Source: GitHub Advisory Database (reviewed) High CVE-2020-9491

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.nifi:nifi >= 1.2.0, < 1.12.0-RC1 1.12.0-RC1

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

References

External links from the advisory. They lead to third-party sites.