CVE-2020-9491: High severity apache nifi vulnerability
In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-9491?
CVE-2020-9491 is a vulnerability in Apache NiFi 1.2.0 to 1.11.4 where the NiFi UI and API were not fully protected by TLS v1.2 and allowed insecure connections.
What is the severity of CVE-2020-9491?
The severity of CVE-2020-9491 is high with a CVSS score of 7.5.
How does CVE-2020-9491 affect Apache NiFi?
CVE-2020-9491 affects Apache NiFi versions 1.2.0 to 1.11.4, exposing the NiFi UI and API to potential insecure connections.
How can I fix CVE-2020-9491?
To fix CVE-2020-9491, upgrade your Apache NiFi installation to a version above 1.11.4 that fully protects the NiFi UI and API with TLS v1.2.
Where can I find more information about CVE-2020-9491?
More information about CVE-2020-9491 can be found on the official Apache NiFi security page and the CVE database.