[
https://issues.apache.org/jira/browse/IMPALA-15216?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113484#comment-18113484
]
ASF subversion and git services commented on IMPALA-15216:
----------------------------------------------------------
Commit 7d1a2b8b8d7bd3ef5af27ff1f1c09348bb6c1c7d in impala's branch
refs/heads/master from Csaba Ringhofer
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=7d1a2b8b8 ]
IMPALA-15216: Fix bearer token signature check in SAML auth
This fix is done downstream first to avoid early public
exposure.
Testing:
- added test to check that modified bearer tokens are rejected
- added test to check that repeated bearer tokens are rejected
(this already worked before the patch)
Change-Id: I9d5f2bc9036a2de0f7efbc9e13cb5eb9c123d7fd
Reviewed-on: http://gerrit.cloudera.org:8080/24796
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> SAML authentication bypass via forged bearer token
> --------------------------------------------------
>
> Key: IMPALA-15216
> URL: https://issues.apache.org/jira/browse/IMPALA-15216
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend, Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 5.0.0, Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-56207
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
