Information Exposure Affecting org.apache.nifi:nifi-web-security Open this link in a new tab package, versions [,1.11.1)
Do your applications use this vulnerable package?
12 Feb 2020
11 Feb 2020
How to fix?
org.apache.nifi:nifi-web-security to version 1.11.1 or higher.
org.apache.nifi:nifi-web-security is a system to process and distribute data.
Affected versions of this package are vulnerable to Information Exposure. The flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.