Loading vulnerability…
JMXRMI Registry Rebinding Man-in-the-Middle in Apache Flink
CVE-2020-1960 is a man-in-the-middle vulnerability in Apache Flink versions 1.1.0 through 1.10.0. It occurs when a Flink process has JMXReporter enabled and configures a reporter port. A local attacker with access to the machine and JMX port can send a specially crafted request that rebinds the JMXRMI registry to an attacker-controlled registry. This allows the attacker to intercept and compromise JMX connections made to the affected Flink process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker that successfully rebinds the JMXRMI registry can compromise JMX connections to the affected Flink process and extract credentials and other data transferred through those connections.
If you can’t patch tonight, do this now.
Until patched versions are deployed, restrict local access to hosts running affected Flink processes, limit access to the JMX port, and avoid the vulnerable configuration of an enabled JMXReporter with a configured reporter port.
Patch, then assume compromise.
Upgrade affected Apache Flink installations to 1.9.3 or later on the 1.9.x branch, or 1.10.1 or later on the 1.10.x branch. Later Flink releases also contain the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.