CVE-2021-28131

CVE-2021-28131 (Impala): The vulnerability arises because a 16-byte session secret is logged, enabling an authenticated user to hijack another user’s session and execute statements with privileges not held. Affected deployments with Apache Sentry, Apache Ranger, or audit logging may face privileg...

CVE-2019-10084

CVE-2019-10084 affects Apache Impala 2.7.0 to 3.2.0. An authenticated user who can observe the IDs of active queries or sessions can craft requests to interact with those sessions/queries, potentially bypassing authorization and audit controls. Root causes noted include: session/query IDs are uni...

CVE-2017-5652

The CVE-2017-5652 entry concerns Apache Impala (incubating) versions 2.7.0–2.8.0 where one port used by the StatestoreSubscriber did not employ the secure Thrift transport when TLS was enabled. This allowed an attacker with network access to eavesdrop on plaintext data traversing that port, const...