[KUDU-1843] Client UUIDs should be cryptographically random

• Type: Improvement
• Status: In Review
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Component/s: security
• Target Version/s: 1.13.0
• Code Review: https://gerrit.cloudera.org/#/c/6347/
• Assignee: Todd Lipcon
• Reporter: Todd Lipcon
• Created: 21/Jan/17 00:46
• Updated: 02/Jun/20 16:34

Description

Currently we use boost::uuid's default random generator, which is not cryptographically random. This may increase the ease with which an attacker could guess another client's client ID, which would potentially allow them to perform DoS or try to steal the results of RPCs from the result cache.

Issue Links

• duplicates: KUDU-1918 Prevent hijacking of scanners by other users