You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by gi...@apache.org on 2026/02/16 17:09:20 UTC
(nifi-site) branch asf-site updated: Published changes from 99292db86e18baf5e394f687b756d37e7624ed6f
This is an automated email from the ASF dual-hosted git repository.
github-bot pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/nifi-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new fd7ffb79 Published changes from 99292db86e18baf5e394f687b756d37e7624ed6f
fd7ffb79 is described below
commit fd7ffb794690aad0e6afaf2747d312a2cda13f40
Author: github-actions[bot] <41...@users.noreply.github.com>
AuthorDate: Mon Feb 16 17:09:15 2026 +0000
Published changes from 99292db86e18baf5e394f687b756d37e7624ed6f
---
community/powered-by/index.html | 2 +-
documentation/guides/fds-releases/index.html | 2 +-
documentation/guides/licensing/index.html | 2 +-
.../guides/maven-plugin-releases/index.html | 2 +-
documentation/guides/signing/index.html | 2 +-
documentation/index.html | 2 +-
documentation/security/index.html | 48 +++++++++++++++++++++-
sitemap.xml | 38 ++++++++---------
8 files changed, 72 insertions(+), 26 deletions(-)
diff --git a/community/powered-by/index.html b/community/powered-by/index.html
index eb081fb6..102adb11 100644
--- a/community/powered-by/index.html
+++ b/community/powered-by/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="powered-by-apache-hahahugoshortcode11s0hbhb">Powered by Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="powered-by-apache-hahahugoshortcode9s0hbhb">Powered by Apache <span class="ni">Ni</span><span class="fi">Fi</span>
</h1>
<h2 id="cloudera"><a href="https://cloudera.com">Cloudera</a></h2>
<p>Cloudera offers several capabilities for data ingestion and data flow design to enable universal data distribution from
diff --git a/documentation/guides/fds-releases/index.html b/documentation/guides/fds-releases/index.html
index 68d9cb38..ceb01c32 100644
--- a/documentation/guides/fds-releases/index.html
+++ b/documentation/guides/fds-releases/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="apache-hahahugoshortcode21s0hbhb-flow-design-system-releases">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode16s0hbhb-flow-design-system-releases">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
Flow Design System Releases</h1>
<p>The purpose of this document is to capture and describe the steps involved in producing
an official release of Apache NiFi Flow Design System. It is written specifically to someone acting in the
diff --git a/documentation/guides/licensing/index.html b/documentation/guides/licensing/index.html
index e4bb09fe..10e7efd9 100644
--- a/documentation/guides/licensing/index.html
+++ b/documentation/guides/licensing/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="apache-hahahugoshortcode24s0hbhb-licensing">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode18s0hbhb-licensing">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
Licensing</h1>
<p>This document provides guidance to contributors of Apache NiFi to help properly account for licensing, notice, and legal requirements.</p>
<h4 id="disclaimer">Disclaimer:</h4>
diff --git a/documentation/guides/maven-plugin-releases/index.html b/documentation/guides/maven-plugin-releases/index.html
index c3aa9c92..de501b3a 100644
--- a/documentation/guides/maven-plugin-releases/index.html
+++ b/documentation/guides/maven-plugin-releases/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="apache-hahahugoshortcode26s0hbhb-nar-maven-plugin-releases">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode20s0hbhb-nar-maven-plugin-releases">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
NAR Maven Plugin Releases</h1>
<p>The purpose of this document is to capture and describe the steps involved in producing
an official release of Apache NiFi NAR Maven Plugin. It is written specifically to someone acting in the
diff --git a/documentation/guides/signing/index.html b/documentation/guides/signing/index.html
index 859094dc..3da85862 100644
--- a/documentation/guides/signing/index.html
+++ b/documentation/guides/signing/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="apache-hahahugoshortcode27s0hbhb-commit-and-release-signing">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode22s0hbhb-commit-and-release-signing">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
Commit and Release Signing</h1>
<p>The purpose of this document is to capture and describe the steps involved in generating and verifying cryptographic signatures of official releases of Apache NiFi, as well as configuring cryptographic signatures of individual code commits. It is written for contributors, committers, and users of Apache NiFi (and related applications).</p>
<h2 id="table-of-contents"><a name="table-of-contents">Table of Contents</a></h2>
diff --git a/documentation/index.html b/documentation/index.html
index 19661ff4..118e92b7 100644
--- a/documentation/index.html
+++ b/documentation/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container iframe-container">
- <h1 id="apache-hahahugoshortcode10s0hbhb-documentation">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode11s0hbhb-documentation">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
Documentation</h1>
<h2 id="configuration-and-component-properties">Configuration and Component Properties</h2>
<ul>
diff --git a/documentation/security/index.html b/documentation/security/index.html
index ca5ec3fa..40b4a869 100644
--- a/documentation/security/index.html
+++ b/documentation/security/index.html
@@ -563,7 +563,7 @@
</div>
<main>
<div class="uk-container">
- <h1 id="apache-hahahugoshortcode15s0hbhb-security">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
+ <h1 id="apache-hahahugoshortcode14s0hbhb-security">Apache <span class="ni">Ni</span><span class="fi">Fi</span>
Security</h1>
<p>Apache NiFi welcomes the responsible reporting of security vulnerabilities. Project Management Committee members will
collaborate and respond to potential vulnerabilities, providing an assessment of the concern and a plan of action to
@@ -615,6 +615,52 @@ contrary to best practices, but it does not constitute of security issue for rem
</ul>
<h1 id="published-vulnerabilities">Published Vulnerabilities</h1>
<p>The following announcements include published vulnerabilities that apply directly to Apache NiFi components.</p>
+<div class="vulnerability-container">
+ <h3 id="CVE-2026-25903">CVE-2026-25903</h3>
+
+ <ul>
+ <li>Title: Deserialization of Untrusted Data in GetAsanaObject Processor</li>
+ <li>Published: 2026-02-16</li>
+ <li>Severity: High</li>
+ <li>Products: Apache NiFi</li>
+ <li>Affected Versions: 1.1.0 to 2.7.2</li>
+ <li>Fixed Versions: 2.8.0</li>
+ <li>Reporter: David Handermann</li>
+ <li>References
+ <ul>
+ <li>
+ CVE Record: <a href="https://www.cve.org/CVERecord?id=CVE-2026-25903" target="_blank">CVE-2026-25903</a>
+ </li>
+ <li>
+ NVD Record: <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25903" target="_blank">CVE-2026-25903</a>
+ </li>
+ <li>
+ Apache Jira Issue: <a href="https://issues.apache.org/jira/browse/NIFI-15567" target="_blank">NIFI-15567</a>
+ </li>
+
+ <li>
+ GitHub Pull Request: <a href="https://github.com/apache/nifi/pull/10871" target="_blank">10871</a>
+ </li>
+
+ </ul>
+ </li>
+ </ul>
+
+ <p class="vulnerability-description">
+
+
+Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components
+that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates
+additional privileges required to add the annotated component to the flow configuration, but framework authorization did
+not check restricted status when updating a component previously added. The missing authorization requires a more
+privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make
+property configuration changes. Apache NiFi installations that do not implement different levels of authorization for
+Restricted components are not subject to this vulnerability because the framework enforces write permissions as the
+security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
+
+
+ </p>
+</div>
<div class="vulnerability-container">
<h3 id="CVE-2025-66524">CVE-2025-66524</h3>
diff --git a/sitemap.xml b/sitemap.xml
index 75d1de17..5d46c0c3 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -15,7 +15,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.kafka.service.aws.AmazonMSKConnectionService/</loc>
</url><url>
<loc>https://nifi.apache.org/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.apicurio.schemaregistry.ApicurioSchemaRegistry/</loc>
</url><url>
@@ -66,13 +66,13 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.cef.CEFReader/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/guides/signing/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/community/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.CompressContent/</loc>
</url><url>
@@ -119,7 +119,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.windows.event.log.ConsumeWindowsEventLog/</loc>
</url><url>
<loc>https://nifi.apache.org/community/contact/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.controller.ControllerStatusReportingTask/</loc>
</url><url>
@@ -196,7 +196,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.box.controllerservices.DeveloperBoxClientService/</loc>
</url><url>
<loc>https://nifi.apache.org/development/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.flowanalysis.rules.DisallowComponentType/</loc>
</url><url>
@@ -205,13 +205,13 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.DistributeLoad/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/documentation/v1/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/download/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.DuplicateFlowFile/</loc>
</url><url>
@@ -310,10 +310,10 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.FlattenJson/</loc>
</url><url>
<loc>https://nifi.apache.org/projects/fds/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/documentation/guides/fds-releases/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.ForkEnrichment/</loc>
</url><url>
@@ -402,7 +402,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.grok.GrokReader/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/guides/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.HandleHttpRequest/</loc>
</url><url>
@@ -465,7 +465,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.parameter.KubernetesSecretParameterProvider/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/guides/licensing/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.azure.storage.ListAzureBlobStorage_v12/</loc>
</url><url>
@@ -536,7 +536,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.MergeRecord/</loc>
</url><url>
<loc>https://nifi.apache.org/projects/minifi/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.ModifyBytes/</loc>
</url><url>
@@ -555,7 +555,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.azure.storage.MoveAzureDataLakeStorage/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/guides/maven-plugin-releases/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.registry.flow.NifiRegistryFlowRegistryClient/</loc>
</url><url>
@@ -582,10 +582,10 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.ssl.PEMEncodedSSLContextProvider/</loc>
</url><url>
<loc>https://nifi.apache.org/community/powered-by/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/projects/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.lookup.PropertiesFileLookupService/</loc>
</url><url>
@@ -718,7 +718,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.redis.service.RedisDistributedMapCacheClientService/</loc>
</url><url>
<loc>https://nifi.apache.org/projects/registry/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.RemoveRecordField/</loc>
</url><url>
@@ -781,7 +781,7 @@
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.elasticsearch.SearchElasticsearch/</loc>
</url><url>
<loc>https://nifi.apache.org/documentation/security/</loc>
- <lastmod>2026-02-13T23:45:19+01:00</lastmod>
+ <lastmod>2026-02-16T11:07:08-06:00</lastmod>
</url><url>
<loc>https://nifi.apache.org/components/org.apache.nifi.processors.standard.SegmentContent/</loc>
</url><url>