CVE-2020-1942

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.1 through 1.11.0

Description The issue concerns the flow fingerprint factory in Apache NiFi, which generated flow fingerprints that included sensitive property descriptor values. When a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprints of both the cluster and local flow were printed, potentially exposing sensitive values in plaintext.

Recommendations For Apache NiFi versions 0.0.1 through 1.11.0, consider restricting access to the flow fingerprint factory to minimize the risk of sensitive information exposure until a fix is available.