CVE-2020-17519: Apache Flink directory traversal attack: reading remote files through the REST API

Q: What is the severity of CVE-2020-17519?

CVE-2020-17519 has a medium severity rating as it allows attackers to read any file on the local filesystem of the JobManager.

Q: How do I fix CVE-2020-17519?

To fix CVE-2020-17519, upgrade Apache Flink to version 1.11.3 or later.

Q: What versions of Apache Flink are affected by CVE-2020-17519?

CVE-2020-17519 affects Apache Flink versions from 1.11.0 to 1.11.2.

Q: What is the impact of CVE-2020-17519?

The impact of CVE-2020-17519 is that it allows unauthorized file access, leading to potential data leakage.

Q: Is CVE-2020-17519 specific to any deployment environment?

CVE-2020-17519 is specific to deployments using the JobManager process of Apache Flink.

Published Jan 5, 2021

Updated

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

Other sources

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.

— CISA

Affected Software

4 affected componentsFixes available

Apache Flink>=1.11.0<=1.11.2

maven/org.apache.flink:flink-runtime_2.12>=1.11.0<1.11.3

1.11.3

Apache Flink

Apache Flink>=1.11.0<1.11.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/org.apache.flink:flink-runtime_2.12 to a version that resolves this vulnerability.
Fixed in 1.11.3
Upgrade
Upgrade maven/org.apache.flink:flink-runtime_2.11 to a version that resolves this vulnerability.
Fixed in 1.11.3
Upgrade
Upgrade Apache Flink to a version that resolves this vulnerability.
Fixed in 1.12.0
Upgrade
Upgrade apache/flink:master to a version that resolves this vulnerability.
Patch b561010b0ee741543c3953306037f00d7a9f0801

Event History

Jan 5, 2021

CVE Published

via MITRE·11:40 AM

Data Sourced

via MITRE·11:40 AM

DescriptionWeakness

Jan 6, 2021

Advisory Published

via GitHub·08:01 PM

May 23, 2024

Known Exploited

via CISA·12:00 AM

Data Sourced

via CISA·12:00 AM

RemedyDescriptionAffected Software

May 24, 2024

News Published

via The Register·12:59 AM

News Published

via The Register·01:04 AM

Frequently Asked Questions

What is the severity of CVE-2020-17519?

CVE-2020-17519 has a medium severity rating as it allows attackers to read any file on the local filesystem of the JobManager.

How do I fix CVE-2020-17519?

To fix CVE-2020-17519, upgrade Apache Flink to version 1.11.3 or later.

What versions of Apache Flink are affected by CVE-2020-17519?