Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 24 Oct 2018 12:11:35 -0700
From: Jim Apple <>
Subject: Fwd: CVE-2018-11785 and CVE-2018-11792, was "[ANNOUNCE] Apache Impala
 3.0.1 release"

Apache Impala just released version 3.0.1 to fix CVE-2018-11785 and

---------- Forwarded message ---------
From: Jim Apple <>
Date: Wed, Oct 24, 2018 at 12:09 PM
Subject: CVE-2018-11785 and CVE-2018-11792, was "[ANNOUNCE] Apache Impala
3.0.1 release"
To: <>, dev@...ala <>, Michael
Ho <>, Fredy Wijaya <>, <>

Additionally, this release was mainly to pick up two security fixes:

- Missing authorization check in Apache Impala allows a
Kerberos-authenticated but unauthorized user to inject random data into a
running query, leading to wrong results for a query

CVE-2018-11792 (IMPALA-7502):
- ALTER TABLE/VIEW RENAME required ALTER on the old
table. This may pose a potential security risk, such as having ALTER on a
table and ALL on a particular database allows a user to move the table to a
database with ALL, which will automatically grant that user with ALL
privilege on that table due to the privilege inherited from the database

On Wed, Oct 24, 2018 at 12:05 PM Jim Apple <> wrote:

> The Apache Impala PMC is announcing the release of Impala 3.0.1.
> Impala is a high-performance distributed SQL engine.
> The release is available at
> Thanks,
> Jim Apple on behalf of the Apache Impala PMC

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.