PT-2025-3057 · Cloudera · Cloudera Jdbc Connector For Impala+1

Published 2025-01-16 · Updated 2025-01-18 · CVE-2024-54660

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cloudera JDBC Connector for Hive versions prior to 2.6.26 Cloudera JDBC Connector for Impala versions prior to 2.6.35

Description A JNDI injection issue was discovered, allowing attackers to inject malicious parameters into the JDBC URL. This could lead to remote code execution. The JNDI injection is possible via the JDBC connection property krbJAASFile for the Java Authentication and Authorization Service (JAAS). Using untrusted parameters in the krbJAASFile and/or remote host can trigger JNDI injection in the JDBC URL through the krbJAASFile.

Recommendations For Cloudera JDBC Connector for Hive versions prior to 2.6.26, update to version 2.6.26 or later. For Cloudera JDBC Connector for Impala versions prior to 2.6.35, update to version 2.6.35 or later. As a temporary workaround, consider restricting the use of the krbJAASFile property in the JDBC connection to minimize the risk of exploitation. Avoid using untrusted parameters in the krbJAASFile and/or remote host.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-54660

Affected Products

Cloudera Jdbc Connector For Hive

Cloudera Jdbc Connector For Impala

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-54660 · Security Note
• https://t.me/cvedetector/15657 · Telegram Post
• https://twitter.com/CVEnew/status/1880625666254868958 · Twitter Post
• https://blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179 · Note
• https://twitter.com/VulmonFeeds/status/1880081719576908028 · Twitter Post