Apache NiFi Security

Apache NiFi welcomes the responsible reporting of security vulnerabilities. Project Management Committee members will collaborate and respond to potential vulnerabilities, providing an assessment of the concern and a plan of action to remediate verified issues.

Reporting Policy

Please read the Apache Project Security for Committers policy for general guidelines applicable disclosure of security issues for Apache Software Foundation projects.

Do not perform the following actions after discovering a potential security concern:

• Open a Jira disclosing a security vulnerability to the public
• Send a message to the project mailing lists disclosing a security vulnerability to the public
• Send a message to the project Slack instance disclosing a security vulnerability to the public

Reporting Guidelines

Configuring dangerous operating system commands or custom scripts is not a project security vulnerability. Authenticated and authorized users are responsible for the security of operating system commands and custom code.

Apache NiFi provides a framework for developing processing pipelines using standard and custom components. The framework supports configurable permissions that enable authorized users to execute code using several standard components. Components such as ExecuteProcess and ExecuteStreamCommand support running operating system commands, while other scripted components support executing custom code using different programming languages. Configuring these components with untrusted commands or arguments is contrary to best practices, but it does not constitute of security issue for remediation.

Reporting Process

• Notify the project on initial discovery of a potential security vulnerability
• Provide a reasonable amount of time for an initial assessment and remediation plan
• Limit interaction to accounts under direct control or accounts with explicit permission of the owner
• Avoid privacy violations, destruction of data, and interruption or degradation of services
• Avoid spamming, social engineering, and methods to manipulate project members

Reporting Methods

• Security Mailing List: security@nifi.apache.org
  • Members of the Project Management Committee monitor this private mailing list and respond to disclosures

Severity Ratings

Severity ratings represent the determination of project members based on an evaluation of Common Vulnerability Scoring System calculations.

• Critical: Arbitrary code execution from a remote attacker
• High: Compromise of integrity or availability through resource exhaustion
• Medium: Requires special configuration settings and significant mitigations are available
• Low: Minimal impact and significant difficulty of exploitation

Published Vulnerabilities

The following announcements include published vulnerabilities that apply directly to Apache NiFi components.