[AMBARI-20018] Document security issue related to setting security.agent.hostname.validate to false

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 2.5.0
• Component/s: ambari-server
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 14/Feb/17 21:34
• Updated: 29/May/17 17:14
• Resolved: 15/Feb/17 16:21

Description

Document security issue related to setting security.agent.hostname.validate to "false".

If set to "false", invalid hostnames may be used in OpenSSL commands used to create the agent-side certificates when 2-way SSL is enabled. This could lead to issues when executing OpenSSL as described in CVE-2014-3582. See https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities.

Issue Links

• links to: ReviewBoard