CISA Alert: Urgent Update Needed for Apache Flink Vulnerability

Rohan Timalsina

June 5, 2024 - TuxCare expert team

Attention Apache Flink users! The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added an Apache Flink vulnerability to its Known Exploited Vulnerabilities Catalog, highlighting evidence of its active exploitation. Apache Flink is a popular open-source framework for processing large streams of data. It’s widely used in big data analytics and real-time applications. However, like any software, it is not immune to security flaws.

What’s the Apache Flink Vulnerability?

Tracked as CVE-2020-17519, this issue is an improper access control vulnerability that affects Apache Flink versions 1.11.0, 1.11.1, and 1.11.2. It allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Additionally, a remote unauthenticated attacker can exploit this flaw by sending a specially crafted directory traversal request to obtain unauthorized access to sensitive information.

An improper access control vulnerability occurs when a system or application does not adequately restrict access to its resources. This means unauthorized users can gain access to data or perform actions they should not have permission to use. These vulnerabilities can lead to unauthorized actions such as viewing, modifying, or deleting sensitive information, and can significantly compromise the security of an application or system.

Mitigation and Recommendations

The vulnerability was addressed in January 2021 with the release of Apache Flink versions 1.11.3 and 1.12.0. Users of affected versions are strongly encouraged to upgrade to these versions or later to mitigate the risk associated with CVE-2020-17519.

For Federal Civilian Executive Branch (FCEB) agencies, the CISA has mandated a deadline of June 13, 2024, to address this vulnerability. This directive aligns with Binding Operational Directive (BOD) 22-01, which requires Federal agencies to fix any vulnerabilities on the Known Exploited Vulnerabilities Catalog. However, this is a critical security issue, and all organizations using Flink are strongly advised to prioritize patching as soon as possible.

Conclusion

The Apache Flink vulnerability (CVE-2020-17519) serves as a critical reminder of the importance of timely patching of known security flaws. Organizations using Apache Flink should immediately upgrade to the fixed versions. By doing so, they can safeguard sensitive information and reduce their exposure to cyberattacks.

The sources for this article include a story from TheHackerNews.

Summary