PT-2019-5835 · Apache · Apache Sentry+2
Publicado
2019-11-05
·
Atualizado
2020-08-24
·
CVE-2019-10084
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Impala versions 2.7.0 through 3.2.0
Description
The issue allows an authenticated user with access to the IDs of active Impala queries or sessions to potentially bypass authorization and audit mechanisms by interacting with those sessions or queries via a specially-constructed request. This could lead to privilege escalation in Impala deployments with Apache Sentry or Apache Ranger authorization enabled, or incorrect audit logging. The session and query IDs, although unique and random, are not treated as sensitive secrets and may be exposed in logs or interfaces. Moreover, they are vulnerable to random number generator attacks, as they were not generated with a cryptographically secure random number generator. Constructing an attack requires a high degree of technical sophistication and access to the Impala system as an authenticated user.
Recommendations
For Apache Impala versions 2.7.0 through 3.2.0, consider restricting access to session and query IDs to minimize the risk of exploitation, and ensure that all users with access to the Impala system have the least privileges necessary to perform their tasks. As a temporary workaround, consider implementing additional monitoring and logging to detect potential unauthorized access to sessions or queries. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of Insufficiently Random Values
Missing Encryption of Sensitive Data
Incorrect Permission
Session Fixation
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Impala
Apache Ranger
Apache Sentry