Approved changes feed: RSS · Atom
cpe:2.3:a:apache:flume:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Flume (0ac69fb4-8802-505d-9a24-4a10b0d31281) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wp-plugins/keep-backup-daily |
purl2cpe | 2026-06-01 10:14:29.635052 |
pkg:github/wpplugins/keep-backup-daily |
purl2cpe | 2026-06-01 10:14:29.635054 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-42468 |
vulnerable | 2026-06-08 05:49:30.025350 |
Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Published: 2022-10-26T00:00:00.000Z
Updated: 2025-05-07T13:53:00.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34916 |
vulnerable | 2026-06-08 05:46:04.017142 |
Improper Input Validation (JNDI Injection) in JMSMessageConsumer
Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Published: 2022-08-21T08:15:19.000Z
Updated: 2024-08-03T09:22:10.646Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25167 |
vulnerable | 2026-06-08 05:41:45.468400 |
Apache Flume vulnerable to a JNDI RCE in JMSSource
Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Published: 2022-06-14T07:55:10.000Z
Updated: 2024-08-03T04:36:05.047Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.