HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. This affects features that store sensitive data in extended attributes, such as HDFS encryption secrets. References: https://seclists.org/oss-sec/2019/q1/91
Mitigation: If a file contains sensitive data in extended attributes, users and admins need to change the permission to prevent others from listing the directory which contains the file.
This vulnerability is out of security support scope for the following product: * Red Hat JBoss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.