Hbase Apache Hbase

Do you want an email whenever new security vulnerabilities are reported in Apache Hbase?

By the Year

In 2024 there have been 0 vulnerabilities in Apache Hbase . Hbase did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2024 0 0.00
2023 0 0.00
2022 0 0.00
2021 0 0.00
2020 0 0.00
2019 2 7.50
2018 1 8.10

It may take a day or so for new Hbase vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apache Hbase Security Vulnerabilities

An issue was discovered in the protobuf crate before 2.6.0 for Rust

CVE-2019-15544 7.5 - High - August 26, 2019

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.

Allocation of Resources Without Limits or Throttling

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4

CVE-2019-0212 7.5 - High - March 28, 2019

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP

CVE-2018-8025 8.1 - High - June 27, 2018

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

Race Condition

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Apache Hbase or by Apache? Click the Watch button to subscribe.

Apache
Vendor

Apache Hbase
Product

subscribe