CVE-2015-1836: Apache HBase Incorrect ACLs Vulnerability
Summary
CVE-2015-1836: High severity vulnerability that affects org.apache.hbase:hbase. Affects org.apache.hbase:hbase across 3 version ranges.
>= 0.98, < 0.98.12.1
>= 1.0.0, < 1.0.1.1
>= 1.1.0, < 1.1.0.1
Fixed in 0.98.12.1, 1.0.1.1 or 1.1.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HBase is an open-source, distributed, non-relational database built on top of Apache Hadoop. It provides random, real-time read/write access to large datasets. The vulnerability identified as CVE-2015-1836 affects versions 0.98 to 0.98.12.1, 1.0 to 1.0.1.1, and 1.1 to 1.1.0.1 of Apache HBase. This vulnerability impacts IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2, as well as other products. The vulnerability arises from the incorrect access control lists (ACLs) used for ZooKeeper coordination state.
Vulnerability Detail
The vulnerability allows remote attackers to exploit Apache HBase and perform various malicious activities. These include causing a denial of service (DoS) by causing a daemon outage, obtaining sensitive information, or modifying data through unspecified client traffic. The incorrect ACLs used for ZooKeeper coordination state enable unauthorized access and manipulation of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.98, < 0.98.12.10.98.12.1 -
>= 1.0.0, < 1.0.1.11.0.1.1 -
>= 1.1.0, < 1.1.0.11.1.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest secure version of Apache HBase.
Conclusion
The vulnerability identified as CVE-2015-1836 in Apache HBase poses a high risk to the security and integrity of the system. It is crucial to promptly upgrade to the fixed versions of Apache HBase to mitigate the risk of a denial of service, unauthorized access, or data modification. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hbase:hbase →
FAQ
Apache HBase is an open-source, distributed, non-relational database built on top of Apache Hadoop. It provides random, real-time read/write access to large datasets.
Versions 0.98 to 0.98.12.1, 1.0 to 1.0.1.1, and 1.1 to 1.1.0.1 of Apache HBase are affected by this vulnerability.
This vulnerability can lead to a denial of service (DoS) by causing a daemon outage, unauthorized access to sensitive information, or modification of data through unspecified client traffic.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache HBase. For versions 0.98, upgrade to version 0.98.12.1 or later. For versions 1.0, upgrade to version 1.0.1.1 or later. For versions 1.1, upgrade to version 1.1.0.1 or later.
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest secure version of Apache HBase.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hbase:hbase.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.