CVE-2022-34916

Improper Input Validation (JNDI Injection) in JMSMessageConsumer

State: Published
Severity: Not scored
Published: Aug 21, 2022
Updated: Aug 3, 2024
Reserved: Jul 4, 2022

Description

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Apache FlumeApache Software Foundation	flume-jms-source to before 1.11.0Affectedfrom 1.4.0Affected

References

https://issues.apache.org/jira/browse/FLUME-3428
https://lists.apache.org/thread/qkmt4r2t9tbrxrdbjg1m2oczbvczd9zn

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.