CVE-2019-0212: Improper Authorization in org.apache.hbase:hbase
Summary
CVE-2019-0212: Improper Authorization in org.apache.hbase:hbase. Affects org.apache.hbase:hbase across 2 version ranges.
>= 2.0.0, < 2.0.5
>= 2.1.0, < 2.1.4
Fixed in 2.0.5 or 2.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HBase is an open-source, distributed, non-relational database built on top of Apache Hadoop. It provides random, real-time read/write access to large datasets. The HBase REST server allows users to interact with HBase using RESTful APIs. This vulnerability affects versions 2.0.0 to 2.0.4 and 2.1.0 to 2.1.3 of Apache HBase. When HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication, authorization is incorrectly applied to users of the HBase REST server. As a result, requests sent to the REST server are executed with the permissions of the REST server itself, rather than the end-user's permissions.
Vulnerability Detail
The vulnerability arises due to the incorrect application of authorization in the HBase REST server. When the REST server is configured with SPNEGO authentication, requests are executed with the permissions of the server instead of the end-user. This issue only affects HBase installations with Kerberos authentication, enabled HBase authorization, and SPNEGO authentication for the REST server. The impact of this vulnerability is limited to the HBase REST server and does not extend beyond it.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.52.0.5 -
>= 2.1.0, < 2.1.42.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the vulnerability in Apache HBase allows unauthorized access to the HBase REST server when certain authentication and authorization configurations are in place. To mitigate this issue, it is recommended to upgrade to the fixed versions of Apache HBase. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hbase:hbase →
FAQ
Apache HBase is an open-source, distributed, non-relational database built on top of Apache Hadoop. It provides random, real-time read/write access to large datasets.
The HBase REST server allows users to interact with HBase using RESTful APIs.
This vulnerability affects HBase installations with Kerberos authentication, enabled HBase authorization, and SPNEGO authentication for the REST server. It allows requests sent to the REST server to be executed with the permissions of the server instead of the end-user.
The vulnerability is limited to the HBase REST server and does not extend beyond it.
To fix this vulnerability, upgrade to the fixed versions of Apache HBase: 2.0.5 or later for versions 2.0.0 to 2.0.4, and 2.1.4 or later for versions 2.1.0 to 2.1.3.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hbase:hbase.
