CVE-2020-1942: 
Java vulnerability analysis and mitigation

CVE-2020-1942 is a security vulnerability discovered in Apache NiFi versions 0.0.1 to 1.11.0. The vulnerability was disclosed on February 4, 2020, and affects the flow fingerprint factory component of Apache NiFi. The issue involves the potential disclosure of sensitive property descriptor values in application logs (NVD, Apache Security).

The vulnerability stems from the flow fingerprint factory generating flow fingerprints that included sensitive property descriptor values. When a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow would be printed in the logs, potentially exposing sensitive values in plaintext. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive information through application logs. When certain cluster operations occur, sensitive property descriptor values could be leaked in plaintext form, potentially compromising the security of the affected systems (Apache Security).

The vulnerability was fixed in Apache NiFi version 1.11.1. The fix implemented Argon2 secure hashing to provide a deterministic loggable value that does not reveal the sensitive value. Users running any version prior to 1.11.1 should upgrade to the fixed version (Apache Security).