PT-2019-5835 · Apache · Apache Sentry+2
Published
2019-11-05
·
Updated
2020-08-24
·
CVE-2019-10084
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Impala versions 2.7.0 through 3.2.0
Description
The issue allows an authenticated user with access to the IDs of active Impala queries or sessions to potentially bypass authorization and audit mechanisms by interacting with those sessions or queries via a specially-constructed request. This could lead to privilege escalation in Impala deployments with Apache Sentry or Apache Ranger authorization enabled, or incorrect audit logging. The session and query IDs, although unique and random, are not treated as sensitive secrets and may be exposed in logs or interfaces. Moreover, they are vulnerable to random number generator attacks, as they were not generated with a cryptographically secure random number generator. Constructing an attack requires a high degree of technical sophistication and access to the Impala system as an authenticated user.
Recommendations
For Apache Impala versions 2.7.0 through 3.2.0, consider restricting access to session and query IDs to minimize the risk of exploitation, and ensure that all users with access to the Impala system have the least privileges necessary to perform their tasks. As a temporary workaround, consider implementing additional monitoring and logging to detect potential unauthorized access to sessions or queries. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of Insufficiently Random Values
Missing Encryption of Sensitive Data
Incorrect Permission
Session Fixation
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Impala
Apache Ranger
Apache Sentry