Vulnerability in Apache Impala
CVE-2017-5652
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift transport when TLS was turned on. It was therefore possible for an adversary, with access to the network, to eavesdrop on the packets going to and coming from that port and view the data in plaintext.
EPSS: 0.012 (65.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Impala — versions 2.7.0, 2.8.0
- Apache Software Foundation Impala — versions 2.7.0 to 2.8.0 incubating
Weakness classification (CWE)
References
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_BUGTRAQ)
Frequently asked questions
- What is CVE-2017-5652?
- CVE-2017-5652 is a high-severity vulnerability in Apache Impala, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2017-07-10.
- How severe is CVE-2017-5652?
- High severity. CVSS v3 base score is 7.5 out of 10.