CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs

[Andy LoPresto <alopresto () apache org>]

The https://nifi.apache.org/security.html <https://nifi.apache.org/security.html> page has been updated with 1 
vulnerability discovered in previous NiFi versions which has been resolved in release 1.11.1. The severity of this 
issue was determined to be ‘important'. Questions about this vulnerability can be directed to security () nifi apache 
org <mailto:security () nifi apache org>.

CVE-2020-1942: Apache NiFi information disclosure in logs

Severity: Important

Versions Affected: Apache NiFi 0.0.1 - 1.11.0

Description: The flow fingerprint factory generated flow fingerprints which included sensitive property descriptor 
values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint 
of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.

Mitigation: Implemented Argon2 secure hashing to provide a deterministic loggable value which does not reveal the 
sensitive value. Users running any previous NiFi release should upgrade to the latest release.

Released: February 4, 2020

If you identify new security issues within the NiFi 1.11.1 release, please forward your report to security () nifi 
apache org <mailto:security () nifi apache org> and do not disclose the issue publicly. The security vulnerability 
reporting and disclosure process can be found here: https://www.apache.org/security/committers.html 
<https://www.apache.org/security/committers.html>.

Andy LoPresto
alopresto () apache org
alopresto.apache () gmail com
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4  BACE 3C6E F65B 2F7D EF69