Description
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user.
This issue affects Apache Impala: >=4.0.0.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Impala | 4.0.0 – ≤ 4.5.1 | — |
References
- https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs vendor-advisory