CVE-2016-8746: Apache Ranger Policy Engine Path Matching Vulnerability
Summary
CVE-2016-8746: Apache Ranger policy engine incorrectly matches paths in certain conditions. Affects org.apache.ranger:ranger-plugins-common versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source security framework that provides centralized authorization and access control for Hadoop ecosystem components. It allows administrators to define and manage fine-grained policies to control user access to various resources. The vulnerability affects the org.apache.ranger:ranger package.
Vulnerability Detail
The Apache Ranger policy engine has a path matching vulnerability in certain conditions. When a policy does not contain wildcards and has the recursion flag set to true, the policy engine incorrectly matches paths. This can lead to unauthorized access to resources that should be restricted. The vulnerability has a moderate severity rating with a CVSS score of 5.9. It can potentially be exploited by attackers to bypass access controls and gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
0.6.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading to Apache Ranger 0.6.3 or later.
Conclusion
The Apache Ranger Policy Engine Path Matching Vulnerability (CVE-2016-8746) affects the org.apache.ranger:ranger package. It allows unauthorized access to resources under certain conditions, potentially leading to data breaches or unauthorized actions. To fix this vulnerability, users should upgrade to Apache Ranger 0.6.3 or later. No workaround is available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger-plugins-common →
FAQ
Apache Ranger is an open-source security framework for managing authorization and access control in the Hadoop ecosystem.
The vulnerability allows unauthorized access to resources when certain conditions are met, potentially leading to data breaches or unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and it will analyze and alert you in real-time.
No, there is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading to Apache Ranger 0.6.3 or later.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger-plugins-common.
