Date: Thu, 24 Jan 2019 13:34:21 +0900 From: Akira Ajisaka <aajisaka@...che.org> To: general@...oop.apache.org, user@...oop.apache.org, "<security@...oop.apache.org>" <security@...oop.apache.org>, oss-security@...ts.openwall.com Subject: CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization Severity: Important Vendor: The Apache Software Foundation Versions Affected: 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, 2.5.0 to 2.7.5 Description: HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. This affects features that store sensitive data in extended attributes, such as HDFS encryption secrets. Mitigation: If a file contains sensitive data in extended attributes, users and admins need to change the permission to prevent others from listing the directory which contains the file. Credit: This issue was discovered by Rushabh Shah.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.