Vulnerability-Lookup

CNVD-2019-09278

Vulnerability from cnvd - Published: 2019-04-01

Title

Apache Hbase授权绕过漏洞

Description

Apache Hbase是美国阿帕奇（Apache）软件基金会的一套构建在Apache Hadoop和Apache ZooKeeper上的面向列的分布式数据库。该数据库适用于非结构化数据存储。 Apache Hbase 2.0.0版本至2.0.4和2.1.0版本至2.1.3版本中存在安全漏洞，该漏洞源于程序未能正确地授权HBase REST服务器用户。攻击者可通过发送请求利用该漏洞以HBase REST服务器权限执行请求。

Severity

低

Patch Name

Apache Hbase授权绕过漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-0212

Impacted products

Name
['Apache HBase >=2.0.0，<=2.0.4', 'Apache HBase >=2.1.0，<=至2.1.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0212"
    }
  },
  "description": "Apache Hbase\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u6784\u5efa\u5728Apache Hadoop\u548cApache ZooKeeper\u4e0a\u7684\u9762\u5411\u5217\u7684\u5206\u5e03\u5f0f\u6570\u636e\u5e93\u3002\u8be5\u6570\u636e\u5e93\u9002\u7528\u4e8e\u975e\u7ed3\u6784\u5316\u6570\u636e\u5b58\u50a8\u3002\n\nApache Hbase 2.0.0\u7248\u672c\u81f32.0.4\u548c2.1.0\u7248\u672c\u81f32.1.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u6388\u6743HBase REST\u670d\u52a1\u5668\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5HBase REST\u670d\u52a1\u5668\u6743\u9650\u6267\u884c\u8bf7\u6c42\u3002",
  "discovererName": "Gaurav Kanade",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09278",
  "openTime": "2019-04-01",
  "patchDescription": "Apache Hbase\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u6784\u5efa\u5728Apache Hadoop\u548cApache ZooKeeper\u4e0a\u7684\u9762\u5411\u5217\u7684\u5206\u5e03\u5f0f\u6570\u636e\u5e93\u3002\u8be5\u6570\u636e\u5e93\u9002\u7528\u4e8e\u975e\u7ed3\u6784\u5316\u6570\u636e\u5b58\u50a8\u3002\r\n\r\nApache Hbase 2.0.0\u7248\u672c\u81f32.0.4\u548c2.1.0\u7248\u672c\u81f32.1.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u6388\u6743HBase REST\u670d\u52a1\u5668\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5HBase REST\u670d\u52a1\u5668\u6743\u9650\u6267\u884c\u8bf7\u6c42\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Hbase\u6388\u6743\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache HBase \u003e=2.0.0\uff0c\u003c=2.0.4",
      "Apache HBase \u003e=2.1.0\uff0c\u003c=\u81f32.1.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-0212",
  "serverity": "\u4f4e",
  "submitTime": "2019-04-01",
  "title": "Apache Hbase\u6388\u6743\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2019-0212 (GCVE-0-2019-0212)

Vulnerability from cvelistv5 – Published: 2019-03-28 21:24 – Updated: 2024-08-04 17:44

Summary

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

Severity ?

No CVSS data available.

CWE

Missing Authorization

Assigner

apache

References

URL

Tags

	http://www.openwall.com/lists/oss-security/2019/03/27/3	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/66535e15007c…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/107624	vdb-entryx_refsource_BID
	https://lists.apache.org/thread.html/b0656d359c7d…	mailing-listx_refsource_MLIST
	https://lists.apache.org/thread.html/519eb0fd4564…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache	Apache HBase	Affected: Apache HBase 2.0.0-2.0.4 Affected: 2.1.0-2.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:14.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E"
          },
          {
            "name": "107624",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107624"
          },
          {
            "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
          },
          {
            "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HBase",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HBase 2.0.0-2.0.4"
            },
            {
              "status": "affected",
              "version": "2.1.0-2.1.3"
            }
          ]
        }
      ],
      "datePublic": "2019-03-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing Authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-21T15:06:02",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2%40%3Cdev.hbase.apache.org%3E"
        },
        {
          "name": "107624",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107624"
        },
        {
          "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
        },
        {
          "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2019-0212",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HBase",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache HBase 2.0.0-2.0.4"
                          },
                          {
                            "version_value": "2.1.0-2.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Missing Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/03/27/3"
            },
            {
              "name": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E",
              "refsource": "CONFIRM",
              "url": "https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E"
            },
            {
              "name": "107624",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107624"
            },
            {
              "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"
            },
            {
              "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2019-0212",
    "datePublished": "2019-03-28T21:24:07",
    "dateReserved": "2018-11-14T00:00:00",
    "dateUpdated": "2024-08-04T17:44:14.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-09278

CVE-2019-0212 (GCVE-0-2019-0212)

Tags

Sightings

Nomenclature