QwikSec

Security Database

CVE

CWE

Training

CVE-2022-25167

Published: Jun 14, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Vendor	Product	Versions
Apache Software Foundation	Apache Flume	affected `flume-jms-source - < 1.10.0`

Weaknesses (CWE)

References

https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg

x_refsource_MISC

https://issues.apache.org/jira/browse/FLUME-3416

x_refsource_MISC

[oss-security] 20220614 CVE-2022-25167 - Apache Flume JMSSource does not protect from malicious JNDI urls

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.