======================================================================

                                CERT-Renater

                     Note d'Information No. 2024/VULN494
_____________________________________________________________________

DATE                : 22/11/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache NiFi versions prior to
                                      2.0.0, 1.28.1.

=====================================================================
https://lists.apache.org/thread/sjmx355j41hnh4f6gzksrsk4lowvd0sj
_____________________________________________________________________

CVE-2024-52067: Apache NiFi: Potential Insertion of Sensitive
Parameter Values in Debug Log
Affected versions:

- Apache NiFi 1.16.0 through 1.28.0
- Apache NiFi 2.0.0-M1 through 2.0.0-M4

Description:

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4
include optional debug logging of Parameter Context values during
the flow synchronization process. An authorized administrator with
access to change logging levels could enable debug logging for
framework flow synchronization, causing the application to write
Parameter names and values to the application log. Parameter
Context values may contain sensitive information depending on
application flow configuration. Deployments of Apache NiFi
with the default Logback configuration do not log Parameter
Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is
the recommendation mitigation, eliminating Parameter value
logging from the flow synchronization process regardless of
the Logback configuration.

This issue is being tracked as NIFI-13971

Credit:

David Handermann (finder)


References:

https://nifi.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-52067
https://issues.apache.org/jira/browse/NIFI-13971



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================