CVE-2022-25167: 
Java vulnerability analysis and mitigation

Apache Flume versions 1.4.0 through 1.9.0 were identified with a remote code execution (RCE) vulnerability, tracked as CVE-2022-25167. The vulnerability was discovered by the Flume development team and publicly disclosed on June 14, 2022. The issue affects configurations that use a JMS Source with a JNDI LDAP data source URI, particularly when an attacker has control of the target LDAP server (CVE Details).

The vulnerability exists in Flume's JMSSource class, which can be configured with a connection factory name. The core issue lies in the JNDI lookup process, which is performed on this name without proper validation, potentially leading to the deserialization of untrusted data. The severity of this vulnerability is classified as medium (Openwall).

When exploited, this vulnerability could allow attackers to execute remote code on affected systems through the deserialization of untrusted data when using the JMS Source component with JNDI LDAP data source URIs (NVD).

The vulnerability has been fixed in Apache Flume version 1.10.0, which implements stricter protocol validation. In the new version, if a protocol is specified in the connection factory parameter, only the java protocol is allowed. If no protocol is specified, it is also allowed. For versions 1.4.0 through 1.9.0, it is recommended not to use the JMSSource component (Openwall).