Vulnerability in Apache Impala
CVE-2017-9792
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This violates and works around the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" commands is enforced to precisely avoid this scenario where a malicious user can change the underlying Kudu table mapping. The fix is to enforce the same privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.016 (74.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Apache Impala — versions 2.8.0, 2.9.0
- Apache Software Foundation Impala — versions 2.8.0 incubating, 2.9.0 incubating
Weakness classification (CWE)
References
- issues.apache.org/jira/browse/IMPALA-5638 (Issue Tracking, Vendor Advisory)
- www.securityfocus.com/bid/101173 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255… (mailing-list)
Frequently asked questions
- What is CVE-2017-9792?
- CVE-2017-9792 is a medium-severity vulnerability in Apache Impala, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.5/10. Published 2017-10-04.
- How severe is CVE-2017-9792?
- Medium severity. CVSS v3 base score is 6.5 out of 10.