CVE-2019-12421
First published: Tue Nov 19 2019(Updated: )
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache NiFi | >=1.0.0<=1.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-12421
- https://github.com/apache/nifi/pull/3362
- https://nifi.apache.org/security.html#CVE-2019-12421
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://github.com/apache/nifi/commit/cf6f5172503ce438c6c22c334c9367f774db7b24
- https://github.com/advisories/GHSA-fmqw-vqh5-cwq9 (Advisory)
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2019-12421?
The severity of CVE-2019-12421 is high, with a severity score of 8.8.
How does CVE-2019-12421 impact NiFi versions 1.0.0 to 1.9.2?
When using an authentication mechanism other than PKI, logging out in NiFi versions 1.0.0 to 1.9.2 does not invalidate the authentication token on the server side, allowing the user's client-side token to be used for up to 12 hours after logging out.
Which versions of NiFi are affected by CVE-2019-12421?
NiFi versions 1.0.0 to 1.9.2 are affected by CVE-2019-12421.
How can I fix CVE-2019-12421?
To fix CVE-2019-12421, upgrade to NiFi version 1.10.0 or higher.
Where can I find more information about CVE-2019-12421?
More information about CVE-2019-12421 can be found at the following references: [NVD NIST](https://nvd.nist.gov/vuln/detail/CVE-2019-12421), [GitHub Pull Request](https://github.com/apache/nifi/pull/3362), [NiFi Security](https://nifi.apache.org/security.html#CVE-2019-12421).
- collector/github-advisory-latest
- alias/GHSA-fmqw-vqh5-cwq9
- alias/CVE-2019-12421
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/weakness
- agent/event
- agent/trending
- package-manager/maven
- vendor/apache
- canonical/apache nifi
- version/apache nifi/1.0.0
- version/apache nifi/1.9.2