漏洞标题
N/A
漏洞描述信息
在Cloudera Navigator Key Trustee KMS 5.12和5.13中，不正确的默认ACL值允许远程访问对加密区域键进行删除和未删除API调用。Navigator Key Trustee KMS 包括与Apache Hadoop KMS相同的2个API调用：删除和未删除。这些命令的KMSACL值分别是keytrustee.kms.acl.PURGE和keytrustee.kms.acl.UNDELETE。Key Trustee KMS 5.12.0和5.13.0的ACL默认值是 "*"，这允许任何知道加密区域键名称以及网络访问Key Trustee KMS的人对这些键进行已知加密区域键的调用。这可能会导致之前已删除但尚未删除的键(未删除)的恢复，或删除正在使用的键(删除)，导致加密HDFS数据的访问损失。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Cloudera Navigator Key Trustee KMS 加密问题漏洞
漏洞描述信息
Cloudera Navigator Key Trustee KMS是Cloudera公司的一款自定义秘钥管理服务器。 Cloudera Navigator Key Trustee KMS 5.12版本和5.13版本中存在安全漏洞。攻击者可利用该漏洞恢复之前删除但没有清理的密钥或删除活跃用户的密钥，使其无法访问加密的HDFS数据。
CVSS信息
N/A
漏洞类别
加密问题