Bug 1696003 (CVE-2018-11767)

Summary:	CVE-2018-11767 hadoop: Apache Hadoop KMS ACL regression
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bigdata-qe-bugs, chazlett, ctubbsii, denis.arnaud_fedora, milleruntime, rhs-bugs, sisharma
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/ENTESB-12454
Whiteboard:
Fixed In Version:	hadoop 2.7.7, hadoop 2.8.5, hadoop 2.9.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 09:52:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1696004
Bug Blocks:	1696005

Description Pedro Sampaio 2019-04-04 02:35:49 UTC

After the security fix for CVE-2017-15713, KMS has an access control regression, blocking users or granting access to users incorrectly, if the system
uses non-default groups mapping mechanisms such as LdapGroupsMapping, CompositeGroupsMapping, or NullGroupsMapping.

References:

https://seclists.org/oss-sec/2019/q1/173

Comment 1 Pedro Sampaio 2019-04-04 02:37:41 UTC

Created hadoop tracking bugs for this issue:

Affects: fedora-all [bug 1696004]

Comment 2 Siddharth Sharma 2019-05-06 10:35:37 UTC

rhs-hadoop is no longer supported in Red Hat Gluster Storage 3. For additional information: https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.1/html/3.1_update_3_release_notes/chap-documentation-3.1_update_3_release_notes-deprecations

Comment 4 Joshua Padman 2019-05-15 23:02:33 UTC

This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.