CVE-2022-42468: Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
First published: Wed Oct 26 2022(Updated: )
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Flume | >=1.4.0<=1.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-42468
- https://issues.apache.org/jira/browse/FLUME-3437
- https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz
- https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78
- https://github.com/apache/flume/commit/eee179a09df405c1ab55ae25a53b76ca1050bb97
- https://github.com/advisories/GHSA-9w4g-fp9h-3q2v (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-42468?
CVE-2022-42468 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-42468?
To fix CVE-2022-42468, upgrade Apache Flume to version 1.10.2 or later, ensuring that the providerURL used with JMS Source is safe.
Who is affected by CVE-2022-42468?
CVE-2022-42468 affects all Apache Flume versions from 1.4.0 to 1.10.1 that utilize an unsafe providerURL in their configuration.
What type of attack does CVE-2022-42468 allow?
CVE-2022-42468 allows for remote code execution (RCE) attacks that can compromise the system running Apache Flume.
What mitigation strategies can be employed for CVE-2022-42468?
Mitigation strategies for CVE-2022-42468 include restricting the use of JNDI to only allow the java protocol or eliminating the use of protocols altogether.
- collector/github-advisory
- alias/GHSA-9w4g-fp9h-3q2v
- alias/CVE-2022-42468
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/apache
- canonical/apache flume
- version/apache flume/1.4.0
- version/apache flume/1.10.1