Vulnerability Description
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift transport when TLS was turned on. It was therefore possible for an adversary, with access to the network, to eavesdrop on the packets going to and coming from that port and view the data in plaintext.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Impala | 2.7.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/archive/1/540831/100/0/threaded
- https://lists.apache.org/thread.html/5bab4424f23aebefc8108a0e30273c2a543a289df81
- http://www.securityfocus.com/archive/1/540831/100/0/threaded
- https://lists.apache.org/thread.html/5bab4424f23aebefc8108a0e30273c2a543a289df81
FAQ
What is CVE-2017-5652?
CVE-2017-5652 is a vulnerability with a CVSS score of 7.5 (HIGH). During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in ...
How severe is CVE-2017-5652?
CVE-2017-5652 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5652?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Impala.