https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Bug ID: 1293837 Summary: CVE-2015-1772 Apache Hive: authentication vulnerability in HiveServer2 Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: alonbl@redhat.com, bmcclain@redhat.com, dblechte@redhat.com, ecohen@redhat.com, gklein@redhat.com, java-sig-commits@lists.fedoraproject.org, lsurette@redhat.com, me@coolsvap.net, mgoldboi@redhat.com, michal.skrivanek@redhat.com, moceap@hotmail.com, pmackinn@redhat.com, rbalakri@redhat.com, Rhev-m-bugs@redhat.com, sherold@redhat.com, ydary@redhat.com, yeylon@redhat.com, ykaul@redhat.com
The following flaw was reported in Apache Hive:
Users who use LDAP authentication mode in HiveServer2 and also have LDAP configured to allow simple unauthenticated or anonymous bind.
LDAP services are sometimes configured to allow simple unauthenticated binds. When HiveServer2 is configured to use LDAP authentication mode (hive.server2.authentication configuration parameter is set to LDAP), with such LDAP configurations, it can allow users without proper credentials to get authenticated.
External References:
https://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgu...
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1293838
--- Comment #1 from Martin Prpic mprpic@redhat.com ---
Created hive tracking bugs for this issue:
Affects: fedora-all [bug 1293838]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1293838 [Bug 1293838] CVE-2015-1772 Apache Hive: authentication vulnerability in HiveServer2 [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1293839
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |50521,reported=20150526,sou |50521,reported=20150526,sou |rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N |/AC:M/Au:N/C:P/I:P/A:P,fedo |/AC:M/Au:N/C:P/I:P/A:P,fedo |ra-all/hive=affected,rhev-m |ra-all/hive=affected,rhev-m |-3/jasperreports-server-pro |-3/jasperreports-server-pro |=affected |=noaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2016-01-12 18:53:41
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |50521,reported=20150526,sou |50521,reported=20150526,sou |rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N |/AC:M/Au:N/C:P/I:P/A:P,fedo |/AC:M/Au:N/C:P/I:P/A:P,fedo |ra-all/hive=affected,rhev-m |ra-all/hive=affected,rhev-m |-3/jasperreports-server-pro |-3/jasperreports-server-pro |=noaffected |=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1293837
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |50521,reported=20150526,sou |50521,reported=20150526,sou |rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N |/AC:M/Au:N/C:P/I:P/A:P,fedo |/AC:M/Au:N/C:P/I:P/A:P,fedo |ra-all/hive=affected,rhev-m |ra-all/hive=affected,rhev-m |-3/jasperreports-server-pro |-3/jasperreports-server-pro |=notaffected |=notaffected,cwe=CWE-592
https://bugzilla.redhat.com/show_bug.cgi?id=1293837 Bug 1293837 depends on bug 1293838, which changed state.
Bug 1293838 Summary: CVE-2015-1772 Apache Hive: authentication vulnerability in HiveServer2 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1293838
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org