The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token.

Apache Impala versions 4.0.0 and newer could accept a special token without checking its signature in the final step of SAML2 login.

Four critical and important Apache Impala vulnerabilities expose analytical database clusters to remote code execution and data theft. These flaws affect multiple versions of the software. Currently, security teams have not confirmed any active exploitation or public proof-of-concept exploits. Why This Threat Matters Apache Impala provides high-performance SQL analytics for large Hadoop clusters. A successful exploit could grant an attacker complete administrative control over these databases.

Unlock innovation within your organization with seamless connections made possible by Software AG's API integration platform and microservices.

Unlock innovation within your organization with seamless connections made possible by Software AG's API integration platform and microservices.