Hortonworks Docs » DataFlow 3.2.0 » Release Notes
Release Notes
Also available as:
PDF

CVE-2017-8028

  • Summary: Apache NiFi LDAP TLS issue because of Spring Security LDAP vulnerability
  • Severity: Severe
  • Versions Affected: Apache NiFi 0.1.0 – 15.0
  • Description: Spring Security LDAP library was not enforcing credential authentication after TLS handshake negotiation. See NVD CVE-2017-8028 disclosure for more information.
  • Mitigation: The fix to upgrade the spring-ldap library to 2.3.2.RELEASE+ was applied to the HDF 3.2.0 release. To address this issue, upgrade to HDF 3.2.0.
© 2012–2019, Hortonworks, Inc.
Document licensed under the Creative Commons Attribution ShareAlike 4.0 License.
Hortonworks.com | Documentation | Support | Community