Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
CVE-2022-42468

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Flume
Vendor
CVE Published:
26 October 2022

What is CVE-2022-42468?

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Flume Flume JMSSource < 1.11.0

References

https://issues.apache.org/jira/browse/FLUME-3437
https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1...
https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpyw...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.