CVE-2018-8025 Race condition in org.apache.hbase:hbase-thrift
HighCVSS 8.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hbase/hbase-thrift(Maven) | >= 2.0.0, < 2.0.1 | 2.0.1 |
| org.apache.hbase/hbase-thrift(Maven) | = 2.0.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | >= 1.4.0, < 1.4.5 | 1.4.5 |
| org.apache.hbase/hbase-thrift(Maven) | = 1.4.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.4.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.4.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.4.3 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.4.4 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | >= 1.3.0, < 1.3.2.1 | 1.3.2.1 |
| org.apache.hbase/hbase-thrift(Maven) | = 1.3.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.3.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.3.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | < 1.2.6.1 | 1.2.6.1 |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.0-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.0-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.1.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.1.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.2-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.96.2-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.0-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.0-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.1-hadoop2 | No fix listed |
Show 89 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.10-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.10-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.10.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.10.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.11-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.11-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.12-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.12-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.12.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.12.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.13-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.13-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.14-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.14-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.15-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.15-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.16-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.16-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.16.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.16.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.17-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.17-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.18-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.18-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.19-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.19-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.2-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.2-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.20-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.20-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.21-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.21-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.22-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.22-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.23-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.23-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.24-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.24-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.3-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.3-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.4-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.4-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.5-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.5-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.6-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.6-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.6.1-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.6.1-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.7-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.7-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.8-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.8-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.9-hadoop1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.98.9-hadoop2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.99.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.99.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 0.99.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.0.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.0.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.0.1.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.0.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.0.3 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.0.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.10 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.11 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.12 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.13 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.3 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.4 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.5 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.6 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.7 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.8 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.1.9 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.1 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.2 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.3 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.4 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.5 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | = 1.2.6 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | >= 1.3.0, <= 1.3.2.0 | No fix listed |
| org.apache.hbase/hbase-thrift(Maven) | <= 1.2.6.0 | No fix listed |
| apache hbase | >= 1.0.0, <= 2.0.0 | No fix listed |
| apache hbase | = 0.92.0 | No fix listed |
| Apache HBase | = Apache Tomcat 1.x and 2.x, excluding 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com vendor-advisory
- issues.apache.org
- lists.apache.org
- 104554 third-party-advisory vdb-entry
- lists.apache.org