CVE-2021-20190: High Severity Vulnerability in Bitnami NiFi Due to Jackson-Databind Misconfiguration
Summary
CVE-2021-20190: A flaw was found in jackson-databind before 2.9.10.7. Affects nifi versions >= 1.7.0, <= 1.12.1. No fix is published. How to fix ↓
Also tracked for
- com.fasterxml.jackson.core:jackson-databind · Maven
- jackson-databind · Debian:11
The same CVE-2021-20190 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami NiFi is an open-source data integration tool that enables the automation of data flows between systems. It provides a user-friendly interface for designing data pipelines and supports various data formats and protocols. However, a vulnerability in the Jackson-databind library, which is used for serializing and deserializing Java objects, has been identified, potentially compromising data confidentiality and system integrity.
Vulnerability Detail
A flaw was found in Jackson-databind before version 2.9.10.7, where FasterXML mishandles the interaction between serialization gadgets and typing. This vulnerability can lead to unauthorized access to sensitive data, data corruption, and system unavailability, posing a significant risk to applications utilizing the affected versions of NiFi.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing strict input validation and sanitization to mitigate the risk of exploitation. Additionally, limit access to the NiFi instance to trusted networks only.
Conclusion
The CVE-2021-20190 vulnerability in Bitnami NiFi poses significant risks to data confidentiality and system integrity. It is crucial to upgrade to the patched version to mitigate these risks. For those unable to upgrade immediately, implementing workarounds can help reduce exposure.
See every vulnerability recorded for nifi →
FAQ
CVE-2021-20190 is a high-severity vulnerability in the Jackson-databind library used by Bitnami NiFi, which can lead to data confidentiality and integrity issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized data access, data corruption, and system downtime, affecting the overall integrity and availability of your application.
Yes, upgrading to Bitnami NiFi version 1.12.2 or later will patch this vulnerability.
Implement strict input validation and limit access to the NiFi instance to trusted networks as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
