GHSA-9w4g-fp9h-3q2vCriticalCVSS 9.8

Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Published
October 26, 2022
Last Modified
July 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-42468 →

📋 Description

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.

🎯 Affected products1

  • maven/org.apache.flume.flume-ng-sources:flume-jms-source:< 1.11.0

🔗 References (6)