CVE-2022-34916

Published: Aug 21, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Affected (1)

Products: Apache: Flume

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Flume	From 1.4.0 to 1.10.1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://issues.apache.org/jira/browse/FLUME-3428

Source: security@apache.org

Issue TrackingVendor Advisory

https://lists.apache.org/thread/qkmt4r2t9tbrxrdbjg1m2oczbvczd9zn

Source: security@apache.org

Mailing ListPatchVendor Advisory

https://issues.apache.org/jira/browse/FLUME-3428

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://lists.apache.org/thread/qkmt4r2t9tbrxrdbjg1m2oczbvczd9zn

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

Timeline

No history available yet.