CVE-2019-0212 Improper Authorization in org.apache.hbase:hbase

What is CVE-2019-0212?

CVE-2019-0212 is a high-severity missing authorization vulnerability in Apache HBase, published on 28 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

Which versions are affected by CVE-2019-0212?

4 open source packages ship an affected version, including org.apache.hbase:hbase. It affects 1 product.

Products include Apache Hbase.

How do I fix CVE-2019-0212?

Upgrade org.apache.hbase:hbase to a fixed version for your release line: 2.0.5 or 2.1.4.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-0212 being exploited?

There is no known exploitation of CVE-2019-0212 in the wild and no public exploit code.

Other vulnerabilities in Apache HBase

• CVE-2018-8025 Race condition in org.apache.hbase:hbase-thrift High 8.1
• CVE-2019-15544 Uncontrolled memory consumption in protobuf High 7.5
• CVE-2015-1836 High severity vulnerability that affects org.apache.hbase:hbase High 7.3
• CVE-2026-49326 Apache HBase: Missing scanner instance owner check in thrift delegation service Medium 6.5
• CVE-2013-2193 Security feature bypass in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-535v-4x9q-446c.