SECURITY: Fixed Vulnerability
Details
| Detail name | Value |
|---|---|
| Changelog Number | 11018 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 6.2.0, Exasol 7.0.0, Exasol 7.1.0 |
| Fix Versions | Exasol 7.1.5, Exasol 7.0.15 |
| Resolution Date | 2022-01-26 |
Vulnerability
Classification: Medium
A logged-in database user could possibly read data of sessions that belong to other users.
This vulnerability only occurs if users have at least one of the following privileges:
- Create and use custom adapters for virtual schemas.
- Setting the property EXCLUDED_CAPABILITIES for virtual schemas.
- Use of a virtual schema based on the dialects "BigQuery", "DynamoDB", "File on S3", "Row-Level Security", or "Row-Level Security (Lua)".
- Use of a virtual schema for which the property EXCLUDED_CAPABILITIES is set to a non-empty value.
Workaround
Prevent the access to the affected virtual schemas and virtual schema properties.
Fix
The vulnerability was fixed and users are advised to update to Exasol 7.0.15 or 7.1.5.
