CVE-2018-8025

CVE-2018-8025 describes a race condition in the Apache HBase optional Thrift 1 API server over HTTP where authenticated sessions could be incorrectly applied to users. The issue affects the Thrift 1 endpoint and can cause session misassignment (e.g., a user becoming another user or an unauthentic...

Authorization Bypass

hbase-thrift is vulnerable to authorization bypasses. The library contains a race-condition where authenticated sessions could get mixed up and cause users to be authenticated as another user. This only affects the optional Thrift 1 API server...

XML External Entity (XXE)

hbase-rest is vulnerable to XML External Entity XXE injection. This is possible because it does not block external entities from being parsed...

CVE-2015-1836

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service daemon outage, obtai...

Design/Logic Flaw

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service daemon outage, obtai...

CVE-2015-1836

CVE-2015-1836 affects Apache HBase as used in IBM InfoSphere BigInsights (3.0.x). The vulnerability is a logic/ACL flaw in ZooKeeper coordination state: insecure ACL handling allows a remote attacker to read/modify data or cause a denial of service by exploiting ZooKeeper access controls. IBM’s b...

CVE-2015-1836

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service daemon outage, obtai...

Apache Storm User Interface Arbitrary Code Execution Vulnerability

Apache Storm is a free, open source distributed real-time computing system. Apache Storm has a security vulnerability that allows a remote user to connect to the UI backend program and execute arbitrary code on the system. Using Kerberos authentication for users, remote users can spoof arbitrary...

Multiple Remote Vulnerabilities in Apache HBase

Apache HBase is a database for online services with native support for Hadoop, making it an obvious choice for applications that base their data processing on the scalability and flexibility of Hadoop. HBase versions 0.98.0 - 0.98.12, 1.0.0 - 1.0.1, and 1.1.0 have logic errors that can be handled...

CVE-2013-2193

Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors...

Authentication flaw

Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors...

CVE-2013-2193

Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors...

CVE-2013-2193

Apache HBase 0.92.x (pre-0.92.3) and 0.94.x (pre-0.94.9) with Kerberos enabled is affected. An attacker in MITM position can disable bidirectional RPC authentication between client and RegionServer, potentially leaking sensitive information via unspecified vectors. Root cause: RPC bidirectional a...

Apache HBase RPC身份验证中间人安全措施绕过漏洞(CVE-2013-2193)

BUGTRAQ ID: 61981 CVECAN ID: CVE-2013-2193 HBase是一个分布式、版本化、构建在Apache Hadoop和Apache ZooKeeper上的列数据库 HBase 0.92.x、0.94.x版本在实现上存在安全绕过漏洞，从客户端到Region服务器的RPC流量可能会被具有任务运行权限的恶意用户及集群容器截获。Apache HBase RPC协议用来提供客户端和服务器之间的双向身份验证。但是恶意服务器或网络攻击者可以单方面禁用这些身份验证检查。这可导致绕过RPC流量保护机制。如果通过RPC传递身份验证凭证，也可导致权限提升 0 Apache...

hbase-master-info NSE Script

Retrieves information from an Apache HBase Hadoop database master HTTP status page. Information gathered: Hbase version Hbase compile date Hbase root directory Hadoop version Hadoop compile date Average load Zookeeper quorum server Associated region servers Script Arguments slaxml.debug See the...

hbase-region-info NSE Script

Retrieves information from an Apache HBase Hadoop database region server HTTP status page. Information gathered: HBase version HBase compile date A bunch of metrics about the state of the region server Zookeeper quorum server Script Arguments slaxml.debug See the documentation for the slaxml...