CVE-2020-9491

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.2.0 through 1.11.4

Description The issue concerns the support of outdated TLS versions in intracluster communication. Specifically, cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1, despite the NiFi UI and API mandating TLS v1.2.

Recommendations For Apache NiFi versions 1.2.0 through 1.11.4, consider updating the configuration to only support TLS v1.2 or later for intracluster communication to minimize the risk of exploitation.