CVE-2018-17194
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Cuando una petición de cliente a un nodo del clúster se replicó a otros nodos en el clúster para verificarlos, se redireccionó el Content-Length. En una petición DELETE, el cuerpo fue ignorado, pero si la petición inicial contenía un valor Content-Length diferente de 0, los nodos recibidores esperarían al cuerpo y, finalmente, agotarían su tiempo de conexión. Mitigación: La solución para comprobar las peticiones DELETE y sobrescribir valores de la cabecera Content-Length que no son cero se aplicó en la versión 1.8.0 de Apache NiFi. Los usuarios que ejecuten una distribución 1.x anterior deben actualizarla a la distribución adecuada.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-19 CVE Reserved
- 2018-12-19 CVE Published
- 2024-08-05 CVE Updated
- 2024-10-28 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://nifi.apache.org/security.html#CVE-2018-17194 | 2019-01-11 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apache Search vendor "Apache" | Nifi Search vendor "Apache" for product "Nifi" | >= 1.0.0 <= 1.7.1 Search vendor "Apache" for product "Nifi" and version " >= 1.0.0 <= 1.7.1" | - |
Affected
|