Apache Hbase
By the Year
In 2023 there have been 0 vulnerabilities in Apache Hbase . Hbase did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 7.50 |
| 2018 | 1 | 8.10 |
It may take a day or so for new Hbase vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Hbase Security Vulnerabilities
An issue was discovered in the protobuf crate before 2.6.0 for Rust
CVE-2019-15544
7.5 - High
- August 26, 2019
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Allocation of Resources Without Limits or Throttling
In all previously released Apache HBase 2.x versions (2.0.0-2.0.4
CVE-2019-0212
7.5 - High
- March 28, 2019
In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP
CVE-2018-8025
8.1 - High
- June 27, 2018
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.
Race Condition
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Hbase or by Apache? Click the Watch button to subscribe.
