CVE-2020-1960
Description
A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.
How to fix
- org.apache.flink:flink-core1.9.3, 1.10.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache flink | 1.1.0 ≤ v ≤ 1.1.5, 1.2.0 ≤ v ≤ 1.2.1, 1.3.0 ≤ v ≤ 1.3.3, 1.4.0 ≤ v ≤ 1.4.2, 1.5.0 ≤ v ≤ 1.5.6, 1.6.0 ≤ v ≤ 1.6.4, 1.7.0 ≤ v ≤ 1.7.2, 1.8.0 ≤ v ≤ 1.8.3, 1.9.0 ≤ v ≤ 1.9.2, 1.10.0 | — |
| org.apache.flink:flink-coreMaven | v < 1.9.3, 1.10.0 ≤ v < 1.10.1 | 1.9.3, 1.10.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.