Description
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Impala | 2.7.0 – ≤ 4.5.1 | — |
References
- https://lists.apache.org/thread/2ty3srsh96j86xxg4g1hbo5rwvszwcnl vendor-advisory