CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41180 – Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
https://notcve.org/view.php?id=CVE-2023-41180
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS. Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior. validación incorrecta de certificados en nvokeHTTP sobre Apache NiFi MiNiFi C++ versions 0.13 to 0.14 permite a un intermediario presentar un certificado falsificado durante la negociación del apretón de manos TLS. La propiedad Disable Peer Verification de InvokeHTTP se invirtió de forma efectiva, deshabilitando la verificación por defecto, cuando se utiliza HTTPS. Mitigación: Establezca la propiedad Disable Peer Verification de InvokeHTTP en true cuando utilice las versiones 0.13.0 o 0.14.0 de MiNiFi C++. • https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2021-33191 – MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol
https://notcve.org/view.php?id=CVE-2021-33191
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0 Apache NiFi MiNiFi C++ versión 0.5.0, el protocolo c2 implementa un comando "agent-update" que fue diseñado para parchear el binario de la aplicación. Este comando de "patching" predeterminado llama a un binario confiable, pero puede ser modificado a un valor arbitrario mediante un comando "c2-update". • http://www.openwall.com/lists/oss-security/2021/08/24/1 https://lists.apache.org/thread.html/r6f27a2454f5f67dbe4e21c8eb1db537b01863a0bc3758f28aa60f032%40%3Cannounce.apache.org%3E https://www.openwall.com/lists/oss-security/2021/08/24/1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •