[
https://issues.apache.org/jira/browse/IMPALA-15217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113533#comment-18113533
]
ASF subversion and git services commented on IMPALA-15217:
----------------------------------------------------------
Commit 99c3d7758fc651e651a63ed97ea3d046502e863f in impala's branch
refs/heads/master from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=99c3d7758 ]
IMPALA-15217: Add guards for avro.schema.url
Adds CLI flags `avro_schema_url_allowed_schemes`,
`avro_schema_url_remote_http_enabled`, and
`avro_schema_url_http_allowed_hosts` to provide additional guards on
sending HTTP requests to unexpected hosts or reading from remote
filesystems.
Also protects against HTTP redirects and hung connections.
Adds support for HTTPS Avro schema URLs.
Assisted-by: Claude Sonnet 4.6 (VSCode)
Change-Id: I72c331ea53170644c4b2234b61dbdd880ea23e55
Reviewed-on: http://gerrit.cloudera.org:8080/24801
Reviewed-by: Michael Smith <[email protected]>
Tested-by: Michael Smith <[email protected]>
> Avro Schema URL Server-Side Request Forgery
> -------------------------------------------
>
> Key: IMPALA-15217
> URL: https://issues.apache.org/jira/browse/IMPALA-15217
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend, Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-54048
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
