====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN296
_____________________________________________________________________

DATE                : 10/10/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache NiFi versions 1.x prior to
                                        1.4.0.

=====================================================================
https://nifi.apache.org/security.html#CVE-2017-12623
____________________________________________________________________

CVE-2017-12623: Apache NiFi XXE issue in template XML upload

Apache NiFi PMC would like to announce the discovery and resolution of
CVE-2017-12623. This issue has been resolved and a new version of the
Apache NiFi project was released in accordance with the Apache Release
Process.

Apache NiFi is an easy to use, powerful, and reliable system to process
and distribute data. It supports powerful and scalable directed graphs
of data routing, transformation, and system mediation logic.

Fixed in Apache NiFi 1.4.0 (Released: October 2, 2017)

CVE-2017-12623: Apache NiFi XXE issue when loading template

Severity: Medium

Versions Affected:

Apache NiFi 1.0.0 - 1.3.0

Description: An authorized user could upload a template which contained
malicious code and accessed sensitive files via an XML External Entity
(XXE) attack.

Mitigation: The fix to properly handle XML External Entities was applied
on the Apache NiFi 1.4.0 release. Users running a prior 1.x release
should upgrade to the appropriate release.

Credit: This issue was discovered by Pawel Gocyla.

For more information: https://nifi.apache.org/security.html

Andy LoPresto
alopresto@apache.org
alopresto.apache@gmail.com
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================