CVE-2022-25167: Apache Flume vulnerable to a JNDI RCE in JMSSource
First published: Tue Jun 14 2022(Updated: )
Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.flume.flume-ng-sources:flume-jms-source | >=1.4.0<1.10.0 | 1.10.0 |
| Apache Flume | >=1.4.0<1.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-25167
- https://issues.apache.org/jira/browse/FLUME-3416
- https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg
- http://www.openwall.com/lists/oss-security/2022/06/14/1
- https://github.com/apache/flume/commit/dafb26ccb172141c6e14e95447e1b6ae38e9a7d0
- https://github.com/advisories/GHSA-x5m7-rwfx-w7qm (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-25167?
CVE-2022-25167 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-25167?
To fix CVE-2022-25167, upgrade Apache Flume to version 1.10.0 or later.
Which versions of Apache Flume are affected by CVE-2022-25167?
Apache Flume versions 1.4.0 through 1.9.0 are affected by CVE-2022-25167.
What type of attack is associated with CVE-2022-25167?
CVE-2022-25167 is associated with remote code execution (RCE) attacks.
What component is involved in the vulnerability CVE-2022-25167?
The vulnerability CVE-2022-25167 involves the JMS Source when configured with a JNDI LDAP data source URI.
- collector/github-advisory
- alias/GHSA-x5m7-rwfx-w7qm
- alias/CVE-2022-25167
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/apache
- canonical/apache flume
- version/apache flume/1.4.0