CVE-2019-10084: 
Apache Impala vulnerability analysis and mitigation

A high-severity vulnerability (CVE-2019-10084) was discovered in Apache Impala versions 2.7.0 to 3.2.0. The vulnerability allows authenticated users to potentially bypass authorization and audit mechanisms through interaction with active Impala queries or sessions via specially-constructed requests (Openwall List).

The vulnerability stems from the exposure of session and query IDs which were not properly treated as sensitive secrets. These IDs, while unique and random, were not generated using cryptographically secure random number generators, making them susceptible to random number generator attacks that could predict future IDs based on past ones. The IDs could be exposed through logs or interfaces, creating a potential attack vector (Openwall List).

The vulnerability primarily affects Impala deployments with Apache Sentry or Apache Ranger authorization enabled. An authenticated attacker could potentially escalate privileges by hijacking sessions or queries from other authenticated users who have higher privileges. Additionally, deployments with audit logging enabled could be vulnerable to incorrect audit logging, where actions could be logged under the name of a different authenticated user (Openwall List).

Exploiting this vulnerability requires a high degree of technical sophistication and authenticated access to the Impala system. The attacker needs to be able to access active query or session IDs and construct specialized requests to interact with these sessions (Openwall List).

Users of Impala deployments with Apache Sentry, Apache Ranger, or audit logging should upgrade to Impala 3.3.0 or later, which includes the fix for IMPALA-8605 and implements session secrets to eliminate the risk. Alternative mitigations include restricting access to debug pages, administrative interfaces, and logs that expose session and query IDs, as well as limiting access to the Impala deployment to trusted users only (Openwall List).