|
|
CVE-2020-1960: Apache Flink JMX information disclosure vulnerability
Severity: Medium
(CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H)
Vendor:
The Apache Software Foundation
Versions Affected:
Flink 1.1.0 to 1.1.5
Flink 1.2.0 to 1.2.1
Flink 1.3.0 to 1.3.3
Flink 1.4.0 to 1.4.2
Flink 1.5.0 to 1.5.6
Flink 1.6.0 to 1.6.4
Flink 1.7.0 to 1.7.2
Flink 1.8.0 to 1.8.3
Flink 1.9.0 to 1.9.2
Flink 1.10.0
Description:
When running a process with an enabled JMXReporter, with a port
configured via metrics.reporter.<reporter_name>.port, an attacker with
local access to the machine and JMX port can execute a man-in-the-middle
attack using a specially crafted request to rebind the JMXRMI registry
to one under the attacker's control. This compromises any connection
established to the process via JMX, allowing extraction of credentials
and any other transferred data.
Mitigation:
All users should either
- remove the port parameter from the reporter configuration,
- upgrade to 1.9.3 or 1.10.1,
- obtain the source for their release from the Flink website or git and
apply the patch corresponding to their version from the list below:
1.1: a61b5d2b362d11e7b9deeb2334d275325574bd7b
1.2: d2a051267ffbeef5c1fd981860fb7032d9ac8a60
1.3: 4f06bb75cd726096af43587ca4fb182b2e4bae2e
1.4: 12787eceb49c566b28aa876fc2892d21a0ec3d79
1.5: f9b4e0dea71abbcd6463c757577c70c45b3e6bbf
1.6: b8647b1ca019003ae939b7494bba4e54de167b6f
1.7: 5e0b7970a9aea74aba4ebffaa75c37e960799b93
1.8: 0e8e8062bcc159e9ed2a0d4a0a61db4efcb01f2f
1.9: 58b58f4b16a2e25c95b465377d43a51ad8ef3f6a
1.10: 804ae70024bf8be7c0c7093d02addb080c318662
Credit:
The issue was discovered in Flink by Jonathan Gallimore, Tomitribe and
Colm O hEigeartaigh, Talend.
The underlying vulnerability pattern was discovered by An Trinh and
published at Blackhat.
|
Locked
