You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hbase.apache.org by Josh Elser <el...@apache.org> on 2018/06/22 13:07:45 UTC
CVE-2018-8025 on Apache HBase
CVE-2018-8025 describes an issue in Apache HBase that affects the
optional "Thrift 1" API server when running over HTTP. There is a
race-condition which could lead to authenticated sessions being
incorrectly applied to users, e.g. one authenticated user would be
considered a different user or an unauthenticated user would be treated
as an authenticated user.
https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for
this issue, and this fix is contained in the following releases of
Apache HBase:
* 1.2.6.1
* 1.3.2.1
* 1.4.5
* 2.0.1
This vulnerability affects all 1.x and 2.x release lines (except 1.0.0).
- The Apache HBase PMC