CVE-2016-6815: Apache Ranger Password Change Vulnerability
Summary
CVE-2016-6815: Moderate severity vulnerability that affects org.apache.ranger:ranger. Affects org.apache.ranger:ranger versions < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source security framework that provides centralized security administration for Hadoop ecosystem components. It allows administrators to define and manage fine-grained policies for accessing and auditing data within the Hadoop cluster. The package 'org.apache.ranger:ranger' is a Maven package that includes the Apache Ranger framework.
Vulnerability Detail
A moderate severity vulnerability has been identified in Apache Ranger before version 0.6.2. This vulnerability allows users with the 'keyadmin' role to change the password for users with the 'admin' role. This unauthorized password change can lead to privilege escalation and compromise the security of the Apache Ranger installation.
How To Fix
Minimum fixed version
0.6.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Ranger to mitigate the risk.
Conclusion
The Apache Ranger Password Change Vulnerability (CVE-2016-6815) allows unauthorized password changes for users with the 'admin' role by users with the 'keyadmin' role. To mitigate this vulnerability, it is crucial to upgrade to Apache Ranger version 0.6.2 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework for managing fine-grained access control and auditing for Hadoop ecosystem components.
This vulnerability allows users with the 'keyadmin' role to change the password of users with the 'admin' role, leading to potential privilege escalation and compromising the security of the Apache Ranger installation.
To fix this vulnerability, upgrade to Apache Ranger version 0.6.2 or later, which includes a fix for this issue.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
For more information about this vulnerability, refer to the Apache Ranger security advisory GHSA-vhxc-8jjq-859j.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
