Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'.

The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trustedjarpaths' have a non-empty value configured by the Impala admin.

Users are recommended to upgrade to version 4.5.3, which fixes this issue.

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the aigeneratetext() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.