CVE-2015-1836 High severity vulnerability that affects org.apache.hbase:hbase

What is CVE-2015-1836?

CVE-2015-1836 is a high-severity missing authorization vulnerability in n/a, published on 21 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.

Weakness: CWE-284

Which versions are affected by CVE-2015-1836?

6 open source packages ship an affected version, including org.apache.hbase:hbase. It affects 2 products.

Products include Apache Hbase, Ibm Infosphere Biginsights.

How do I fix CVE-2015-1836?

Upgrade org.apache.hbase:hbase to a fixed version for your release line: 0.98.12.1, 1.0.1.1 or 1.1.0.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2015-1836 being exploited?

There is no known exploitation of CVE-2015-1836 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-8025 Race condition in org.apache.hbase:hbase-thrift High 8.1
• CVE-2019-15544 Uncontrolled memory consumption in protobuf High 7.5
• CVE-2019-0212 Improper Authorization in org.apache.hbase:hbase High 7.5
• CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service Medium 6.5
• CVE-2013-2193 Security feature bypass in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p8xr-4v2c-rvgp.