Improper TLS Protocol Support in Apache NiFi by the Apache Software Foundation

CVE-2020-9491

What is CVE-2020-9491?

In versions 1.2.0 to 1.11.4 of Apache NiFi, the user interface (UI) and Application Programming Interface (API) enforced the use of TLS v1.2 to enhance security for incoming requests. However, intracluster communications like request replication and Site-to-Site communications were still operating under outdated TLS v1.0 and v1.1 protocols. This inconsistency in security protocols could expose sensitive data during transmission, necessitating urgent updates to ensure uniform encryption standards across all communications.

References