CVE-2022-25167: Remote Code Execution in Apache Flume
Summary
CVE-2022-25167: Remote Code Execution in Apache Flume. Affects org.apache.flume.flume-ng-sources:flume-jms-source versions >= 1.4.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Flume is an open-source distributed log collection and aggregation system. It allows for efficient and reliable collection, aggregation, and movement of large amounts of log data. The vulnerable package in Apache Flume is flume-jms-source, which is responsible for integrating JMS (Java Message Service) with Flume. JMS Source with a JNDI LDAP data source URI is affected by this vulnerability.
Vulnerability Detail
The vulnerability in Apache Flume versions 1.4.0 through 1.9.0 allows for remote code execution (RCE) when a configuration uses a JMS Source with a JNDI LDAP data source URI and the attacker has control of the target LDAP server. This means that an attacker can execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further compromise of the system. The issue is resolved by restricting JNDI to only allow the use of the java protocol or no protocol.
How To Fix
Latest published version: 1.11.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to modify the configuration to avoid using a JMS Source with a JNDI LDAP data source URI. Instead, consider using a different data source or protocol that is not affected by this vulnerability. Here is an example of a modified configuration:
# Original configuration
source.jms.type = jms
source.jms.initialContextFactory = com.sun.jndi.ldap.LdapCtxFactory
source.jms.providerUrl = ldap://attacker-controlled-server
# Modified configuration
source.jms.type = jms
source.jms.initialContextFactory = com.sun.jndi.ldap.LdapCtxFactory
source.jms.providerUrl = java://attacker-controlled-server
Conclusion
The vulnerability in Apache Flume versions 1.4.0 through 1.9.0 allows for remote code execution when using a JMS Source with a JNDI LDAP data source URI. It is crucial to upgrade to Apache Flume version 1.10.0 or later to mitigate this vulnerability. If immediate upgrade is not possible, apply the provided workaround to modify the configuration. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.flume.flume-ng-sources:flume-jms-source →
FAQ
Apache Flume is an open-source distributed log collection and aggregation system. It is designed to efficiently collect, aggregate, and move large amounts of log data.
The vulnerable package in Apache Flume is flume-jms-source, which is responsible for integrating JMS (Java Message Service) with Flume.
This vulnerability allows for remote code execution (RCE) when a configuration uses a JMS Source with a JNDI LDAP data source URI and the attacker has control of the target LDAP server. An attacker can execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, it is recommended to upgrade to Apache Flume version 1.10.0 or later. Update the flume-jms-source package to the latest version in your Maven project by modifying the pom.xml file.
If upgrading to the latest version is not immediately feasible, a workaround is to modify the configuration to avoid using a JMS Source with a JNDI LDAP data source URI. Instead, consider using a different data source or protocol that is not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.flume.flume-ng-sources:flume-jms-source.
