Open Source Vulnerabilities

apache-nifi, druid-fips, druid-fips, druid-fips

In Eclipse Jetty, a first HTTP/1

apache-nifi

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

apache-nifi

Authorization handling for component configuration verification requests in Apache NiFi 1

apache-nifi, druid-fips, druid-fips

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

apache-nifi

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks

druid-fips, druid-fips, druid-fips

AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

apache-nifi

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests

consul, etcd, step-cli, traefik, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, coredns-fips, cosign-fips, nats-server-config-reloader-fips

Previously, resolving relative paths containing parent directory ('

apache-nifi

WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authent...

druid-fips, druid-fips, druid-fips

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift

apache-nifi

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials

druid-fips

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr

apache-nifi

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...

apache-nifi

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payl...

apache-nifi, apache-nifi, druid-fips, druid-fips, druid-fips

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

apache-nifi

attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters

apache-nifi

application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2

apache-nifi, apache-nifi, druid-fips, druid-fips, druid-fips

Uncontrolled Resource Consumption vulnerability in the HTTP/1

apache-nifi

Buffer Overflow vulnerability in giflib v

druid-fips, druid-fips, druid-fips

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

apache-nifi

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling

apache-nifi

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

step-cli

Open Redirect vulnerability in the go-chi/chi >=5

apache-nifi, druid-fips, druid-fips, druid-fips

Uncontrolled Recursion vulnerability in Apache Commons

apache-nifi

WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K

apache-nifi

flaw has been found in HdrHistogram up to 2

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi

vulnerability was detected in HdrHistogram up to 2

cosign-fips, cosign-fips

Security fix for GHSA-xm5m-wgh2-rrg3 applied in: cosign-fips 2.6.3-r0, cosign-fips 3.0.6-r1

apache-nifi

ACE vulnerability in conditional configuration file processing by QOS

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

cosign-fips, cosign-fips

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

apache-nifi

Deserialization of untrusted data vulnerability in QOS

apache-nifi

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

cosign-fips, cosign-fips, cosign-fips

sigstore-go is a Go library for Sigstore signing and verification

apache-nifi

Giflib Project v5

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

apache-nifi, druid-fips

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

cosign-fips, cosign-fips, cosign-fips

Security fix for GHSA-pmwq-pjrm-6p5r applied in: cosign-fips 2.5.3-r1, cosign-fips 2.6.3-r2, cosign-fips 3.0.6-r2

druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi, druid-fips

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

apache-nifi, apache-nifi

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

traefik, traefik, cosign-fips, cosign-fips, opentofu, opentofu, opentofu, coredns-fips, cosign-fips

malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

step-cli

Step CA is an online certificate authority for secure, automated certificate management for DevOps

apache-nifi, apache-nifi

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

apache-nifi, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

traefik, cosign-fips, cosign-fips, opentofu, opentofu, opentofu, coredns-fips, cosign-fips

malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

step-cli

attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks