PT-2019-11009 · Cloudera · Cloudera Navigator Key Trustee Kms

Published 2019-06-07 · Updated 2019-06-11 · CVE-2018-6185

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Cloudera Navigator Key Trustee KMS versions 5.12.0 through 5.13.0

Description: The issue arises from incorrect default ACL values in Cloudera Navigator Key Trustee KMS, allowing remote access to purge and undelete API calls on encryption zone keys. The KMS includes two API calls: purge and undelete, with ACL values keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE. The default ACL value of "*" enables anyone with knowledge of an encryption zone key's name and network access to the Key Trustee KMS to make these calls, potentially recovering deleted keys or deleting keys in active use, resulting in loss of access to encrypted HDFS data.

Recommendations: For Cloudera Navigator Key Trustee KMS versions 5.12.0 through 5.13.0, consider restricting access to the keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE ACLs to prevent unauthorized API calls. As a temporary workaround, restrict network access to the Key Trustee KMS to minimize the risk of exploitation. Avoid using the default ACL value "*" for keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE to prevent unauthorized access to encryption zone keys.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2018-6185

Affected Products

Cloudera Navigator Key Trustee Kms

References · 5

• https://osv.dev/vulnerability/CVE-2018-6185 · Vendor Advisory
• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6185 · Security Note
• https://cloudera.com · Vendor Advisory
• https://t.me/cibsecurity/4758 · Telegram Post