Data Exposure Vulnerability in Apache Impala Incubating Product

CVE-2017-9792

What is CVE-2017-9792?

In versions of Apache Impala prior to 2.10.0, a vulnerability allows a user with 'ALTER' permissions on an Impala table to compromise the data integrity of Kudu tables. By changing table properties to mark them as 'external' and altering the table mapping, malicious users can bypass authorization requirements for access to sensitive data across Kudu tables. This scenario highlights a critical flaw in privilege enforcement related to 'ALTER' commands that could lead to unauthorized data exposure. To mitigate this risk, it is essential to implement the same access controls for 'ALTER' commands as are enforced for 'CREATE' operations.

References