Description<\/p>\n
`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,
\nbefore `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving
\n`nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted
\nevery user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`.<\/p>\n
`docs\/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment
\nfollowing the documentation could believe it was restricted while it was not. The failure is silent; nothing
\nin the logs or the configuration indicates that the group list is being ignored.<\/p>\n
Both lists left empty continues to mean that no restriction is configured, which is the shipped default and
\nis unchanged.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set.<\/p>\n
Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended
\nprincipals, since a non-empty user list causes the group list to be evaluated on affected versions.
\nOperators should review Nimbus access logs for operations by principals outside the intended groups.<\/p>\n
Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first
\ntime. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the
\nconfigured groups will begin to be refused.<\/p>\n
Credit<\/p>\n
The ASF — found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,
\nbefore `nimbus.groups` was considered. An operator who restricted cluster acce<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22316","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}