[jira] [Resolved] (KUDU-1918) Prevent hijacking of scanners by other users

["Grant Henke (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KUDU-1918?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Grant Henke resolved KUDU-1918.
-------------------------------
       Resolution: Duplicate
    Fix Version/s: n/a

> Prevent hijacking of scanners by other users
> --------------------------------------------
>
>                 Key: KUDU-1918
>                 URL: https://issues.apache.org/jira/browse/KUDU-1918
>             Project: Kudu
>          Issue Type: Improvement
>          Components: security, tserver
>    Affects Versions: 1.3.0
>            Reporter: Todd Lipcon
>            Assignee: Todd Lipcon
>            Priority: Major
>             Fix For: n/a
>
>
> Currently the UUIDs used for scanner IDs are using boost::uuid, which doesn't necessarily use a secure random source. If these turn out to be predictable, some attack around scanner hijacking might be possible. We should use an unpredictable source for scanner IDs, or save the original authenticated user in the Scanner and ensure that the authentication does not switch mid-scan.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)