PT-2022-26450
CVE-2022-42468
·
تاريخ النشر
2022-10-26
·
تاريخ التحديث
2025-05-07
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Apache Flume versions 1.4.0 through 1.10.1
Description
The issue allows for a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This is due to the JMSSource class being configured with a
providerUrl parameter, which performs a JNDI lookup without validation, potentially leading to the deserialization of untrusted data.Recommendations
For Apache Flume versions 1.4.0 through 1.10.1, update to version 1.11.0 to fix the issue by limiting JNDI to allow only the use of the java protocol or no protocol.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾