Race condition in org.apache.hbase:hbase-thrift

高 8.1CVE-2018-8025 · GHSA-r86j-2gc6-2cq9 · 27/06/2018 公開 · 17/06/2026 更新

要点

CVE-2018-8025 は org.apache.hbase:hbase-thrift, hbase (apache) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.7%（全脆弱性の 77.7% より高い）。
対処：1.3.2.1, 1.4.5, 2.0.1, 1.2.6.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.hbase:hbase-thrift Maven	`≥ 1.3.0, < 1.3.2.1≥ 1.4.0, < 1.4.5≥ 2.0.0, < 2.0.1< 1.2.6.1`	`1.3.2.11.4.52.0.11.2.6.1`
hbase apache	`= 0.92.0> 1.0.0, ≤ 2.0.0`	修正版なし

概要

An issue in Apache HBase affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

NVD の説明

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.