CVE-2018-8025: apache software foundation apache hbase Race Condition

Vulnerability summary

CVE-2018-8025 is a high (CVSS 8.1) Race Condition vulnerability in apache software foundation apache hbase. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.

Timeline

1. 27-06-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.