Description
In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache NiFi | Apache NiFi 0.0.1 to 1.11.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.nifi:nifi-framework-core | >= 0.0.1, < 1.12.0-RC1 | 1.12.0-RC1 | GHSA-7q8g-gpfp-v8gx |
| Maven | org.apache.nifi:nifi-security-utils | >= 0.0.1, < 1.12.0-RC1 | 1.12.0-RC1 | GHSA-7q8g-gpfp-v8gx |