CVE-2018-8025 Race condition in org.apache.hbase:hbase-thrift

What is CVE-2018-8025?

CVE-2018-8025 is a high-severity vulnerability in Apache HBase, published on 27 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

Weakness: CWE-362

Which versions are affected by CVE-2018-8025?

8 open source packages ship an affected version, including org.apache.hbase:hbase-thrift. It affects 1 product.

Products include Apache Hbase.

How do I fix CVE-2018-8025?

Upgrade org.apache.hbase:hbase-thrift to a fixed version for your release line: 1.2.6.1, 1.3.2.1, 1.4.5 or 2.0.1.

Is CVE-2018-8025 being exploited?

There is no known exploitation of CVE-2018-8025 in the wild and no public exploit code.

Other vulnerabilities in Apache HBase

• CVE-2019-15544 Uncontrolled memory consumption in protobuf High 7.5
• CVE-2019-0212 Improper Authorization in org.apache.hbase:hbase High 7.5
• CVE-2015-1836 High severity vulnerability that affects org.apache.hbase:hbase High 7.3
• CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service Medium 6.5
• CVE-2013-2193 Security feature bypass in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r86j-2gc6-2cq9.