You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hive.apache.org by "Ádám Szita (Jira)" <ji...@apache.org> on 2019/11/25 12:07:00 UTC
[jira] [Updated] (HIVE-22533) Fix possible LLAP daemon web UI
vulnerabilities
[ https://issues.apache.org/jira/browse/HIVE-22533?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ádám Szita updated HIVE-22533:
------------------------------
Status: Patch Available (was: Open)
> Fix possible LLAP daemon web UI vulnerabilities
> -----------------------------------------------
>
> Key: HIVE-22533
> URL: https://issues.apache.org/jira/browse/HIVE-22533
> Project: Hive
> Issue Type: Improvement
> Components: llap
> Reporter: Ádám Szita
> Assignee: Ádám Szita
> Priority: Major
> Attachments: HIVE-22533.0.patch
>
>
> Security tools that look for possible vulnerabilities find issues with LLAP daemon web UI:
> * *dir listing* for _images,css,js_ folders
> * *missing X-Frame-Options response header* in the response
> Similarly we should disable dir listing on HS2 web UI /static page too, as it is of no use anyway.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)