CVE-2017-5640

CVE-2017-5640 affects Apache Impala (incubating) versions 2.7.0–2.8.0. A malicious process impersonating an Impala daemon can cause the server to skip authentication checks when Kerberos is enabled but TLS is not, by replying with COMPLETE before the SASL handshake finishes, making the client tre...

CVE-2018-11792

CVE-2018-11792 affects Apache Impala up to version 3.0.1. The issue occurs when performing ALTER TABLE/VIEW RENAME, which requires ALTER on the old table. This can enable privilege escalation: if a user has ALTER on a table and ALL on the database, they can move the table to a database with ALL, ...