oss-security - CVE update (CVE-2016-0735)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <D31EE434.14B879%vel@apache.org>
Date: Mon, 28 Mar 2016 13:37:56 -0400
From: Velmurugan Periasamy <vel@...che.org>
To: "dev@...ger.incubator.apache.org" <dev@...ger.incubator.apache.org>,
	"user@...ger.incubator.apache.org" <user@...ger.incubator.apache.org>,
	<security@...che.org>,
	<oss-security@...ts.openwall.com>,
	<bugtraq@...urityfocus.com>
CC: Velmurugan Periasamy <vel@...che.org>,
	<private@...ger.incubator.apache.org>
Subject: CVE update (CVE-2016-0735) - Fixed in Ranger 0.5.2

Hello:

Here¹s a CVE update for Ranger 0.5.2 release. Please see below details.

Thank you,
Velmurugan Periasamy

--------------------------------------------------------------------------
CVE-2016-0735: Ranger policy excludes flags processing
--------------------------------------------------------------------------
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: 0.5.0/0.5.1 versions of Apache Ranger
Users affected: All users that use Ranger to authorize HBase, Hive, and
Knox.
Description: In some cases, presence of an exclude policy at a
resource-level can give the user access at its parent resource-level. For
example, if a hive policy excludes access for a user to a particular column,
then such a user would be able to alter the name of that table. Only a user
who has access at the table level should be able to do so. Due to this bug
however, the user is able to do the operation when an exclude policy is
present at the column-level for that table.
Mitigation: Users should upgrade to Ranger 0.5.2 version
--------------------------------------------------------------------------

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.