CVE-2020-9491
First published: Thu Oct 01 2020(Updated: )
In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache NiFi | >=1.0.0<=1.11.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf@%3Ccommits.nifi.apache.org%3E
- https://nifi.apache.org/security#CVE-2020-9491
- https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718%40%3Ccommits.nifi.apache.org%3E
Frequently Asked Questions
What is CVE-2020-9491?
CVE-2020-9491 is a vulnerability in Apache NiFi 1.2.0 to 1.11.4 where the NiFi UI and API were not fully protected by TLS v1.2 and allowed insecure connections.
What is the severity of CVE-2020-9491?
The severity of CVE-2020-9491 is high with a CVSS score of 7.5.
How does CVE-2020-9491 affect Apache NiFi?
CVE-2020-9491 affects Apache NiFi versions 1.2.0 to 1.11.4, exposing the NiFi UI and API to potential insecure connections.
How can I fix CVE-2020-9491?
To fix CVE-2020-9491, upgrade your Apache NiFi installation to a version above 1.11.4 that fully protects the NiFi UI and API with TLS v1.2.
Where can I find more information about CVE-2020-9491?
More information about CVE-2020-9491 can be found on the official Apache NiFi security page and the CVE database.
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache nifi
- version/apache nifi/1.0.0
- version/apache nifi/1.11.4