CVE-2017-5640: Critical severity apache impala vulnerability
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5640?
CVE-2017-5640 is classified as a medium severity vulnerability due to potential unauthorized access.
How do I fix CVE-2017-5640?
To fix CVE-2017-5640, upgrade Apache Impala to version 2.9.0 or later where the vulnerability has been addressed.
Which versions of Apache Impala are affected by CVE-2017-5640?
CVE-2017-5640 affects Apache Impala versions 2.7.0 and 2.8.0 when Kerberos is enabled.
What is the impact of CVE-2017-5640?
The impact of CVE-2017-5640 allows a malicious process to impersonate an Impala daemon and potentially bypass authentication.
Is TLS required to exploit CVE-2017-5640?
No, TLS is not required to exploit CVE-2017-5640, as the vulnerability occurs when TLS is disabled.