Apache Accumulo Improper Handling of Insufficient Permissions
Description
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.accumulo:accumulo-masterMaven | >= 1.5.0, < 1.10.1 | 1.10.1 |
org.apache.accumulo:accumulo-masterMaven | >= 2.0.0, < 2.0.1 | 2.0.1 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-grc3-8q8m-4j7cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-17533ghsaADVISORY
- www.openwall.com/lists/oss-security/2020/12/29/1ghsamailing-listx_refsource_MLISTWEB
- github.com/apache/accumulo/commit/56142a89952533fef922fa86739a879c073e7c2aghsaWEB
- github.com/apache/accumulo/commit/877ad502f6857e48342664e4b0ce83db74e4cda4ghsaWEB
- lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3Eghsamailing-listx_refsource_MLISTWEB
- lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3Eghsax_refsource_MISCWEB
- lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed@%3Cannounce.apache.org%3EghsaWEB
News mentions
0No linked articles in our index yet.