Apache Flink patched directory traversal flaw and warned against public exposure

Apache Flink maintainers documented and remediated multiple security issues, highlighting CVE-2020-17518, a directory traversal vulnerability that allowed remote file writing through the REST API, alongside CVE-2020-1960 and CVE-2020-17519. The project’s new security guidance listed affected versions, fix references, and recommended upgrades, while also clarifying that execution of user-supplied code in Flink clusters is expected behavior rather than a standalone remote code execution flaw. Separately, Flink fixed FLINK-19523 to stop sensitive command-line configuration values from being exposed in JobManager logs, with the change released in versions 1.10.3, 1.11.3, and 1.12.0.

The security fixes drove preparation of the Flink 1.10.3 bugfix release, with developers agreeing to backport the CVE-2020-17518 patch to the 1.10 branch while noting that CVE-2020-17519 did not affect 1.10 because it was introduced in 1.11.0. Later user reports of cryptomining on an internet-exposed Flink server did not point to a new vulnerability; maintainers said the known CVEs were already fixed in 1.12.2-rc2 and stressed that exposing the JobManager web port 8081 publicly is dangerous because Flink’s REST endpoint lacks authentication by default in some modes, enabling arbitrary JAR submission. The project strongly advised keeping Flink processes off the public internet and restricting cluster access to trusted internal or cloud networks.