GitHub Advisoryadvisory · Maven

GHSA-p8xr-4v2c-rvgp High severity vulnerability that affects org.apache.hbase:hbase

HIGH Published 2018-10-18 Modified 2021-06-10 Official page ↗
Aliases
CVE-2015-1836
Ecosystem
Maven
Packages
org.apache.hbase:hbase
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-284
Reviewed
2020-06-16

Affected packages

• Maven org.apache.hbase:hbase: >= 0.98, < 0.98.12.1 → fixed in 0.98.12.1 • Maven org.apache.hbase:hbase: >= 1.0.0, < 1.0.1.1 → fixed in 1.0.1.1 • Maven org.apache.hbase:hbase: >= 1.1.0, < 1.1.0.1 → fixed in 1.1.0.1

Description

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.

Related

Alias · CVE (1)

  • CVE-2015-1836 Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References