Matei Mal Badanoiu

The issue is related to insufficient comparison in the Apache NiFi data processing platform. An authenticated and authorized user can bypass connection URL validation using custom input formatting, potentially allowing a remote attacker to gain unauthorized access to protected information. The vulnerability affects several Processors and Controller Services that support JDBC and JNDI JMS access.

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

The issue in Apache NiFi is related to the DBCPConnectionPool and HikariCPConnectionPool Controller Services, which allow an authenticated and authorized user to configure a Database URL with the H2 driver, enabling custom code execution. This can be exploited by a remote attacker to execute arbitrary code. Thousands of organizations are impacted by this issue. The resolution involves validating the Database URL and rejecting H2 JDBC locations.

Name of the Vulnerable Software and Affected Versions: ansible-tower (affected versions not specified) Description: A flaw was found in the default installation of ansible-tower, allowing an attacker to elevate privileges from a low-privileged user to the awx user from outside the isolated environment through Job Isolation escape. The highest threat from this issue is to data confidentiality and integrity, as well as system availability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.