PT-2015-5463 · Apache · Apache Hbase

Enis Söztutar + 1 · Published 2015-12-21 · Updated 2018-10-18 · CVE-2015-1836

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HBase versions 0.98 through 0.98.12.0 Apache HBase versions 1.0 through 1.0.1.0 Apache HBase versions 1.1 through 1.1.0.0

Description The issue allows remote attackers to cause a denial of service, obtain sensitive information, or modify data via unspecified client traffic due to incorrect ACLs for ZooKeeper coordination state.

Recommendations For Apache HBase versions 0.98 through 0.98.12.0, update to version 0.98.12.1 or later. For Apache HBase versions 1.0 through 1.0.1.0, update to version 1.0.1.1 or later. For Apache HBase versions 1.1 through 1.1.0.0, update to version 1.1.0.1 or later.

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-1836

GHSA-P8XR-4V2C-RVGP

Affected Products

Apache Hbase

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-1836 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21969546 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8xr-4v2c-rvgp · Vendor Advisory
• https://cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html · Note
• https://github.com/advisories/GHSA-p8xr-4v2c-rvgp · Note
• http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5izmYccaKjXaJ3V72KK7tbOhbkg%40mail.gmail.com%3E · Note
• http://securitytracker.com/id/1034365 · Note
• http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=[e-mail]%3E · Note