[
https://issues.apache.org/jira/browse/IMPALA-15218?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113536#comment-18113536
]
ASF subversion and git services commented on IMPALA-15218:
----------------------------------------------------------
Commit d7b0619f7969a6bcba89fa1a1167d704c80484a9 in impala's branch
refs/heads/master from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=d7b0619f7 ]
IMPALA-15218: Add trusted_jar_paths for data sources
Adds allowlist `trusted_jar_paths` to identify a safe location for
loading jars for DATA SOURCES and JDBC tables.
Loading arbitrary jars allows code execution, and CREATE TABLE
permissions need to be granted to people separate from the ability to
load any jar. Table properties are difficult to authorize correctly, so
an allowlist is added to put limits on what jars can be loaded into
memory.
To restore prior behavior, specify `trusted_jar_paths` on impalad
startup flags as a comma-separated list of location prefixes for known
JDBC driver jars, such as
`/test-warehouse/data-sources/,hdfs://test-warehouse/data-sources/`.
Also fixes an SQL injection issue and avoids printing dbcp.password in
WARNING logs.
Assisted-by: Claude Sonnet 4.6 (VSCode)
Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1
Reviewed-on: http://gerrit.cloudera.org:8080/24804
Reviewed-by: Michael Smith <[email protected]>
Tested-by: Michael Smith <[email protected]>
> RCE via External Data Source Class Loading
> ------------------------------------------
>
> Key: IMPALA-15218
> URL: https://issues.apache.org/jira/browse/IMPALA-15218
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend, Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 5.0.0, Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-65181
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
