[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAP+3qq7v782VBmeatJTNV5L_wDk1dHsoWFNChAUUvsN7z2Tu1Q@mail.gmail.com>
Date: Thu, 24 Jan 2019 13:34:21 +0900
From: Akira Ajisaka <aajisaka@...che.org>
To: general@...oop.apache.org, user@...oop.apache.org,
"<security@...oop.apache.org>" <security@...oop.apache.org>, oss-security@...ts.openwall.com
Subject: CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization
CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, 2.5.0 to 2.7.5
Description:
HDFS exposes extended attribute key/value pairs during listXAttrs,
verifying only path-level search access to the directory rather than
path-level read permission to the referent. This affects features that
store sensitive data in extended attributes, such as HDFS encryption secrets.
Mitigation:
If a file contains sensitive data in extended attributes, users and admins
need to change the permission to prevent others from listing the directory
which contains the file.
Credit:
This issue was discovered by Rushabh Shah.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
