Release Date: 2019-11-18
Updated: 2019-11-22
Affected Systems:
Apache Group NiFi 1.0.0 - 1.9.2
description:
CVE (CAN) ID: CVE-2019-12421
the Apache NiFi is a software project of the Apache Software Foundation, is designed to automate the flow of data between software systems. The system for routing of data conversion systems, and mediation logic.
Apache NiFi 1.0.0 version to version 1.9.2, a security vulnerability in the authentication mechanism, the vulnerability stems from when the user logs off, NiFi client authentication token failure, rather than the token server failure. An attacker could exploit the vulnerability by sending a request to the API NiFi.
<* Source: Abdu Sahin
*>
suggestions:
Manufacturers patch:
the Apache Group
------------
Current vendors have released an updated patch to fix the security issue, please go to the manufacturer's home page to download:
https://nifi.apache.org/security.html # CVE-2019-12421