257 matches found
CVE-2017-5652
During a routine security analysis, it was found that one of the ports in Apache Impala incubating 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift...
CVE-2017-5652
The CVE-2017-5652 entry concerns Apache Impala (incubating) versions 2.7.0–2.8.0 where one port used by the StatestoreSubscriber did not employ the secure Thrift transport when TLS was enabled. This allowed an attacker with network access to eavesdrop on plaintext data traversing that port, const...
CVE-2017-5640
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala incubating 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. If the malicious server responds with 'COMPLETE' before the SASL handshake has...
CVE-2017-5652
During a routine security analysis, it was found that one of the ports in Apache Impala incubating 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift...
CVE-2017-5640
CVE-2017-5640 affects Apache Impala (incubating) versions 2.7.0–2.8.0. A malicious process impersonating an Impala daemon can cause the server to skip authentication checks when Kerberos is enabled but TLS is not, by replying with COMPLETE before the SASL handshake finishes, making the client tre...
PT-2017-16637
Name of the Vulnerable Software and Affected Versions Apache Impala incubating versions 2.7.0 through 2.8.0 Description A malicious process impersonating an Impala daemon could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. This occurs when the malicio...
PT-2017-16646
Name of the Vulnerable Software and Affected Versions Apache Impala incubating versions 2.7.0 through 2.8.0 Description A security issue was discovered in Apache Impala where data was sent in plaintext over a specific port, even when the cluster was configured to use TLS. This occurred because th...
CVE-2017-5652: Cleartext Transmission of Sensitive Information
During a routine security analysis, it was found that one of the ports in Apache Impala incubating 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift...
CVE-2017-5640: Improper Authentication
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala incubating 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. If the malicious server responds with 'COMPLETE' before the SASL handshake has...
Cloudera CDH Setry Authorization Bypass Vulnerability
CDH is the most complete, tested and widely deployed distribution of Apache Hadoop.CDH is 100% open source and is the only Hadoop solution that offers batch processing, interactive SQL and interactive search, and enterprise-grade continuous availability. A Setry authorization bypass vulnerability...
CVE-2016-6605
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...
Authorization
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...
CVE-2016-6605
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...
CVE-2016-6605
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...
CVE-2016-6605
CVE-2016-6605 affects Cloudera CDH's Impala: versions 5.2.0 through 5.7.2 and 5.8.0 are vulnerable. The root cause is a Setry (likely Sentry) authorization bypass in Impala, enabling remote attackers to bypass access controls. Public documentation in connected sources confirms the affected produc...
PT-2017-9002
Name of the Vulnerable Software and Affected Versions Cloudera Impala versions 5.2.0 through 5.7.2 Cloudera Impala version 5.8.0 Description The issue allows remote attackers to bypass Sentry authorization in Impala, which is part of the Cloudera Distribution of Hadoop CDH. Recommendations For...