CVE-2017-7677: Apache Ranger Hive Authorizer External Location Table Creation Vulnerability
Summary
CVE-2017-7677: Moderate severity vulnerability that affects org.apache.ranger:ranger. Affects org.apache.ranger:ranger versions < 0.7.1. Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Ranger is an open-source security framework that provides fine-grained access control and centralized management for various components in the Apache Hadoop ecosystem. It includes an authorizer module for Apache Hive, which enforces access control policies on Hive tables. The vulnerability affects Apache Ranger versions prior to 0.7.1 and specifically impacts the Hive Authorizer component when external locations are used for Hive tables.
Vulnerability Detail
The vulnerability in Apache Ranger Hive Authorizer allows for the creation of tables in external locations without properly checking the RWX (Read, Write, Execute) permissions. This means that an attacker with unauthorized access to the Hive Authorizer could create tables in external locations without the necessary permissions. This could lead to unauthorized data access, data manipulation, or denial of service attacks.
How To Fix
Minimum fixed version
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Ranger Hive Authorizer External Location Table Creation Vulnerability allows unauthorized creation of tables in external locations, potentially leading to unauthorized data access, data manipulation, or denial of service attacks. It is recommended to upgrade to Apache Ranger version 0.7.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework that provides fine-grained access control and centralized management for various components in the Apache Hadoop ecosystem.
The Hive Authorizer is a component in Apache Ranger that enforces access control policies on Hive tables.
This vulnerability allows unauthorized creation of tables in external locations, potentially leading to unauthorized data access, data manipulation, or denial of service attacks.
To fix this vulnerability, upgrade to Apache Ranger version 0.7.1 or later.
No specific workaround is mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
