cnvd - cnvd-2019-09278

cnvd-2019-09278

Vulnerability from cnvd

Title: Apache Hbase授权绕过漏洞

Description:

Apache Hbase是美国阿帕奇（Apache）软件基金会的一套构建在Apache Hadoop和Apache ZooKeeper上的面向列的分布式数据库。该数据库适用于非结构化数据存储。

Apache Hbase 2.0.0版本至2.0.4和2.1.0版本至2.1.3版本中存在安全漏洞，该漏洞源于程序未能正确地授权HBase REST服务器用户。攻击者可通过发送请求利用该漏洞以HBase REST服务器权限执行请求。

Severity: 低

Patch Name: Apache Hbase授权绕过漏洞的补丁

Patch Description:

Apache Hbase是美国阿帕奇（Apache）软件基金会的一套构建在Apache Hadoop和Apache ZooKeeper上的面向列的分布式数据库。该数据库适用于非结构化数据存储。

Apache Hbase 2.0.0版本至2.0.4和2.1.0版本至2.1.3版本中存在安全漏洞，该漏洞源于程序未能正确地授权HBase REST服务器用户。攻击者可通过发送请求利用该漏洞以HBase REST服务器权限执行请求。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-0212

Impacted products

Name
['Apache HBase >=2.0.0，<=2.0.4', 'Apache HBase >=2.1.0，<=至2.1.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0212"
    }
  },
  "description": "Apache Hbase\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u6784\u5efa\u5728Apache Hadoop\u548cApache ZooKeeper\u4e0a\u7684\u9762\u5411\u5217\u7684\u5206\u5e03\u5f0f\u6570\u636e\u5e93\u3002\u8be5\u6570\u636e\u5e93\u9002\u7528\u4e8e\u975e\u7ed3\u6784\u5316\u6570\u636e\u5b58\u50a8\u3002\n\nApache Hbase 2.0.0\u7248\u672c\u81f32.0.4\u548c2.1.0\u7248\u672c\u81f32.1.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u6388\u6743HBase REST\u670d\u52a1\u5668\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5HBase REST\u670d\u52a1\u5668\u6743\u9650\u6267\u884c\u8bf7\u6c42\u3002",
  "discovererName": "Gaurav Kanade",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09278",
  "openTime": "2019-04-01",
  "patchDescription": "Apache Hbase\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u6784\u5efa\u5728Apache Hadoop\u548cApache ZooKeeper\u4e0a\u7684\u9762\u5411\u5217\u7684\u5206\u5e03\u5f0f\u6570\u636e\u5e93\u3002\u8be5\u6570\u636e\u5e93\u9002\u7528\u4e8e\u975e\u7ed3\u6784\u5316\u6570\u636e\u5b58\u50a8\u3002\r\n\r\nApache Hbase 2.0.0\u7248\u672c\u81f32.0.4\u548c2.1.0\u7248\u672c\u81f32.1.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u6388\u6743HBase REST\u670d\u52a1\u5668\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5HBase REST\u670d\u52a1\u5668\u6743\u9650\u6267\u884c\u8bf7\u6c42\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Hbase\u6388\u6743\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache HBase \u003e=2.0.0\uff0c\u003c=2.0.4",
      "Apache HBase \u003e=2.1.0\uff0c\u003c=\u81f32.1.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-0212",
  "serverity": "\u4f4e",
  "submitTime": "2019-04-01",
  "title": "Apache Hbase\u6388\u6743\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2019-0212 (GCVE-0-2019-0212)

Vulnerability from cvelistv5

Published

2019-03-28 21:24

Modified

2024-08-04 17:44

Severity ?

CWE

Missing Authorization

Summary

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

References

▼	URL	Tags
	http://www.openwall.com/lists/oss-security/2019/03/27/3	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/107624	vdb-entry, x_refsource_BID
	https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache	Apache HBase	Version: Apache HBase 2.0.0-2.0.4 Version: 2.1.0-2.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:14.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E"
          },
          {
            "name": "107624",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107624"
          },
          {
            "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
          },
          {
            "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HBase",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HBase 2.0.0-2.0.4"
            },
            {
              "status": "affected",
              "version": "2.1.0-2.1.3"
            }
          ]
        }
      ],
      "datePublic": "2019-03-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing Authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-21T15:06:02",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E"
        },
        {
          "name": "107624",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107624"
        },
        {
          "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
        },
        {
          "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2019-0212",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HBase",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache HBase 2.0.0-2.0.4"
                          },
                          {
                            "version_value": "2.1.0-2.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Missing Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
            },
            {
              "name": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E",
              "refsource": "CONFIRM",
              "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E"
            },
            {
              "name": "107624",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107624"
            },
            {
              "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"
            },
            {
              "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2019-0212",
    "datePublished": "2019-03-28T21:24:07",
    "dateReserved": "2018-11-14T00:00:00",
    "dateUpdated": "2024-08-04T17:44:14.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted