PT-2017-16646 · Apache · Apache Impala

Published 2017-07-10 · Updated 2019-10-03 · CVE-2017-5652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Impala (incubating) versions 2.7.0 through 2.8.0

Description A security issue was discovered in Apache Impala where data was sent in plaintext over a specific port, even when the cluster was configured to use TLS. This occurred because the StatestoreSubscriber class did not utilize the appropriate secure Thrift transport when TLS was enabled. As a result, an adversary with network access could intercept and view the data in plaintext.

Recommendations For Apache Impala (incubating) versions 2.7.0 through 2.8.0, consider disabling the use of the affected port or restricting access to it until a secure fix is implemented to ensure TLS encryption is properly used.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-5652

Affected Products

Apache Impala

References · 4

• https://osv.dev/vulnerability/CVE-2017-5652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5652 · Security Note
• http://securityfocus.com/archive/1/540831/100/0/threaded · Note
• https://lists.apache.org/thread.html/5bab4424f23aebefc8108a0e30273c2a543a289df8113c461f930143%40%3Cdev.impala.apache.org%3E · Note