CVE-2020-9491

HIGH

Apache NiFi 1.2.0-1.11.4 - Use of a Broken or Risky Cryptographic Algorithm

Title source: llm

Description

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_misc

https://nifi.apache.org/security#CVE-2020-9491

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf%40%3Ccommits.nifi.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718%40%3Ccommits.nifi.apache.org%3E

Scores

CVSS v3 7.5

EPSS 0.0132

EPSS Percentile 80.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-327

Status published

Products (2)

apache/nifi 1.0.0 - 1.11.4

org.apache.nifi/nifi 1.2.0 - 1.12.0-RC1Maven

Published Oct 01, 2020

Tracked Since Feb 18, 2026