A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to
    read any file on the local filesystem of the JobManager through the REST interface of the JobManager
    process. Access is restricted to files accessible by the JobManager process. All users should upgrade to
    Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit
    b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master. (CVE-2020-17519)

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process.

ID	Name	Product	Family	Type	Severity
409422	SCA: security update for org.apache.flink:flink-runtime_2.11, org.apache.flink:flink-runtime_2.12 (GHSA-395w-qhqr-9fr6)	Tenable Cloud Security	SCA Checks	Local	high
409422	SCA: security update for org.apache.flink:flink-runtime_2.11, org.apache.flink:flink-runtime_2.12 (GHSA-395w-qhqr-9fr6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
146314	Apache Flink local file inclusion Vulnerability (direct check)	Nessus	Web Servers	Remote	high

Detections

Analytics

CVE-2020-17519

high

Tenable Plugins

high

high

high