[DRILL-6192] Drill is vulnerable to CVE-2017-12197

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.12.0
• Fix Version/s: 1.13.0
• Labels: ready-to-commit
• Assignee: Volodymyr Tkach
• Reporter: Volodymyr Tkach
• Reviewer: Arina Ielchiieva
• Created: 27/Feb/18 18:09
• Updated: 12/Mar/18 09:31
• Resolved: 10/Mar/18 15:41

Description

The current version of libpam4j bundled with MCS does not perform any authorization check. Any user with valid password could access the cluster even if the user account is disabled/password expired/'not allowed to access the service(pam_access ..)' etc..

Issue Links

• links to: GitHub Pull Request #1136