oss-sec mailing list archives

CVE-2022-25167 - Apache Flume JMSSource does not protect from malicious JNDI urls

From: Ralph Goers <rgoers () apache org>
Date: Tue, 14 Jun 2022 00:22:00 -0700

Severity, medium

Description:

Flume’s JMSSource class can be configured with a connection factory name. A JNDI lookup is performed on this name 
without performing an validation. This could result in untrusted data being deserialized.

Mitigation
Upgrade to Flume 1.10.0.

In releases 1.4.0 through 1.9.0 the JMSSource should not be used.

Release Details
In release 1.10.0, if a protocol is specified in the connection factory parameter only the java protocol will be 
allowed. If no protocol is specified it will also be allowed.

Credit
This issue was found by the Flume development team.

Current thread:

CVE-2022-25167 - Apache Flume JMSSource does not protect from malicious JNDI urls Ralph Goers (Jun 14)