Removed "/jobs" endpoint due to potential privileged information leak
Details
| Detail name | Value |
|---|---|
| Changelog Number | 18760 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 7.1.0, Exasol 8.0.0 |
| Fix Versions | Exasol 8.25.0, Exasol 7.1.27 |
| Resolution Date | 2024-02-15 |
Description
The /jobs endpoint allows authenticated users to fetch ConfD jobs information (results, state, parameters, etc.). Any user had the capability of retrieving a wide list of job attributes, even for jobs not initiated by itself.
In terms of version 7.1 this change applies only to pre-NGA and Docker deployments.
Workaround
There is no workaround.
Fix
The /jobs endpoint has been completely removed. It didn't see any use other than testing.
Changed behavior
The "/jobs" endpoint has been completely removed.
