GitHub Advisoryadvisory · Maven

GHSA-535v-4x9q-446c Improper Authorization in org.apache.hbase:hbase

HIGH Published 2019-04-02 Modified 2022-09-17 Official page ↗
Aliases
CVE-2019-0212
Ecosystem
Maven
Packages
org.apache.hbase:hbase
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hbase:hbase: >= 2.0.0, < 2.0.5 → fixed in 2.0.5 • Maven org.apache.hbase:hbase: >= 2.1.0, < 2.1.4 → fixed in 2.1.4

Description

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

Related

Alias · CVE (1)

  • CVE-2019-0212 In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References