CVE-2018-17194: Input Validation
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-17194?
CVE-2018-17194 is a vulnerability in Apache NiFi where the Content-Length value was forwarded when replicating client requests to other nodes in the cluster.
What is the severity of CVE-2018-17194?
The severity of CVE-2018-17194 is high with a CVSS score of 7.5.
How does CVE-2018-17194 affect Apache NiFi?
CVE-2018-17194 affects Apache NiFi versions between 1.0.0 and 1.7.1.
How can I fix CVE-2018-17194?
To fix CVE-2018-17194, upgrade to Apache NiFi version 1.8.0 or higher.
Where can I find more information about CVE-2018-17194?
More information about CVE-2018-17194 can be found at the NIST NVD website, Apache NiFi security advisory, and the GitHub commit.