Apache HBase Information Leakage Vulnerability

Apache HBase Information Leakage Vulnerability

Apache HBase suffers problems due to remote denial of service, information leakage vulnerability, and information integrity.

Affected Versions:

HBase 0.98.0-0.98.12

HBase 1.0.0-1.0.1

HBase 1.1.0

HBase 0.96 (affected)

Logical errors cause the most secure configuration of HBase to be deployed on ZooKeeper to handle ACLs with insecure Coordination status. Anyone can log on to ZooKeeper through remote access. Related HBase clients will reduce or even completely unavailable. Any authorized user connected to the HBase cluster can modify the parameters and view HBase data information they do not have permission to view.

We recommend that HBase users upgrade their corresponding patch versions (e.g. 0.98.12.1, 1.0.1.1, 1.1.0.1) to ensure that the correct ACLs Information can be written. Any of these patches can be upgraded with zero downtime [1]. Because this logic bug can mask some configuration errors, we encourage users to verify deployment before starting the upgrade process [2.

Once you upgrade to the appropriate version, you must execute a series of ZooKeeper commands on the ZooKeeper client.