CVE-2019-0212: High severity apache hbase vulnerability
In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-0212?
CVE-2019-0212 is classified with a medium severity, indicating significant impacts on security if exploited.
How do I fix CVE-2019-0212?
To fix CVE-2019-0212, upgrade Apache HBase to version 2.1.4 or later, where the authorization issue has been addressed.
What versions of Apache HBase are affected by CVE-2019-0212?
CVE-2019-0212 affects Apache HBase versions 2.0.0 through 2.0.4 and 2.1.0 through 2.1.3.
What are the implications of CVE-2019-0212 for HBase REST server users?
The implications of CVE-2019-0212 include unauthorized access and actions performed under the REST server's permissions rather than the user's permissions.
Is there a workaround for CVE-2019-0212 until I can upgrade?
No official workaround exists for CVE-2019-0212, and upgrading to the fixed version is recommended for adequate protection.