SB2022020325 - Multiple vulnerabilities in Apache Gobblin

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2021-36151)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to Apache Gobblin stores the Hadoop token in clear text inside a temporary file, accessible to all local users. A local user can obtain the token and gain access to the Hadoop database.

2) Improper Certificate Validation (CVE-ID: CVE-2021-36152)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to application trusts all certificates supplied for LDAP connections in Gobblin-as-a-Service. A remote attacker with ability to intercept traffic can perform MitM attack and read or modify transferred information.

Remediation

Install update from vendor's website.

References

• http://seclists.org/oss-sec/2022/q1/121
• http://seclists.org/oss-sec/2022/q1/120