CVE-2017-7676: Apache Ranger Policy Resource Matcher Wildcard Character Handling Vulnerability
Summary
CVE-2017-7676: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character. Affects org.apache.ranger:ranger versions < 0.7.1. Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source security framework that provides centralized security administration for Hadoop ecosystem components. It allows administrators to define and manage fine-grained access policies for various resources. The Policy Resource Matcher is a component in Apache Ranger that matches resource names against policy rules to determine access permissions. This vulnerability affects Apache Ranger versions prior to 0.7.1.
Vulnerability Detail
The Policy Resource Matcher in Apache Ranger before 0.7.1 fails to properly handle wildcard characters. Specifically, it ignores characters after the '' wildcard character. This means that resource names like 'mytest' or 'test*.txt' are not correctly matched against policy rules, leading to unintended behavior. An attacker could exploit this vulnerability to bypass access restrictions and gain unauthorized access to resources.
How To Fix
Minimum fixed version
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Ranger Policy Resource Matcher Wildcard Character Handling Vulnerability (CVE-2017-7676) can allow attackers to bypass access restrictions and gain unauthorized access to resources. It is recommended to upgrade to Apache Ranger version 0.7.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework for managing fine-grained access control policies in the Hadoop ecosystem.
The Policy Resource Matcher is a component in Apache Ranger that matches resource names against policy rules to determine access permissions.
Versions of Apache Ranger prior to 0.7.1 are affected by this vulnerability.
This vulnerability can allow an attacker to bypass access restrictions and gain unauthorized access to resources.
To fix this vulnerability, upgrade to Apache Ranger version 0.7.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
