CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, 2.5.0 to 2.7.5

HDFS exposes extended attribute key/value pairs during listXAttrs,
verifying only path-level search access to the directory rather than
path-level read permission to the referent. This affects features that
store sensitive data in extended attributes, such as HDFS encryption secrets.

If a file contains sensitive data in extended attributes, users and admins
need to change the permission to prevent others from listing the directory
which contains the file.

This issue was discovered by Rushabh Shah.

To unsubscribe, e-mail:
For additional commands, e-mail:

Reply via email to