CyberRota Analysis
AI-GeneratedImpala 4.5.2 is vulnerable to a path traversal attack that allows an attacker to load a malicious JAR file through a relative path specified in the 'trusted_jar_paths' configuration, provided that this path is non-empty. This vulnerability could lead to unauthorized code execution if exploited, making it critical for organizations using Impala to prioritize upgrading to version 4.5.3 to mitigate the risk. Administrators should ensure that 'trusted_jar_paths' is configured securely to prevent potential exploitation.
Original NVD Description
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin. Users are recommended to upgrade to version 4.5.3, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)