Title: Keystore password for the Spark History Server not properly secured
Products affected: Cloudera Manager
Releases affected: 5.11.0
Users affected: All users with TLS enabled for the Spark History Server.
Date/time of detection: April 18, 2017
Severity (Low/Medium/High): Medium
Impact: The keystore password for the Spark History Server is exposed in a world-readable file on the machine running the Spark History Server. The keystore file itself is not exposed.
The password is also visible in the Cloudera Manager UI, by looking at the Spark History Server process’s configuration files.
CVE: CVE-2017-9326
Immediate action required: Upgrade to Cloudera Manager 5.11.1.
Addressed in release/refresh/patch: 5.11.1 or higher.
For the latest update on this issue see the corresponding Knowledge article:
TSB 2017-237: Keystore password for the Spark History Server not properly secured
TSB 2017-237: Keystore password for the Spark History Server not properly secured
All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA
