CVE-2017-5640

CVE-2017-5640: vulnerability in Apache Impala

Published · Updated

Follow this CVE+ Monitor Apache Impala

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.9%
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.
Affected products
Apache Software Foundation · Apache Impala
Related CVEs — Apache Impala

In the same product, most dangerous first.

CVE-2021-28131—Impala logs contain secretsEPSS 3.3%CVE-2018-11792—CVE-2018-11792EPSS 2.5%CVE-2017-9792—CVE-2017-9792EPSS 1.6%CVE-2018-11785—CVE-2018-11785EPSS 1.2%CVE-2017-5652—CVE-2017-5652EPSS 1.2%CVE-2026-57866HIGHApache Impala: Secrets Exfiltration via SSRFEPSS 0.6%