Insert after alter table on Acid table causes ArrayIndexOutOfBoundsException

Issue: Schema evolution is not supported for Acid tables. Alter Table commands on Acid table may make the table unreadable. There is not w/a after that.

Ranger performs authorization check, even if Hive authorization is disabled

When Ranger is Enabled for authorization, it would do the authorization check even if the hive authorization is disabled (via hive.security.authorization.enabled = false).

Alter table transactional=false on ACID table misleading user. create transactional table would be better

Issue: Once an ACID table is created (with transactional=true) and data is written to it, changing the property to transactional=false may cause wrong data to be returned by queries over this table.

Issue: Jobs fail with javax.security.sasl.SaslException

Cause: OpenJDK 7u91 is stricter about validating ticket caches; if there is any ticket in the cache without a default realm, SASL will fail to work.

Workaround: To avoid this problem, the /etc/krb5.conf file must contain a domain_realm section.

Phoenix thin-client jar has incorrect META-INF/services/java.sql.Driver file

Issue: The Phoenix Thin Client Driver, org.apache.phoenix.queryserver.client.Driver, is not automatically registered in the JDBC DriverManager.

Workaround:

HMaster and RegionServers should try to refresh token keys from zk when facing InvalidToken

Issue: Many customers use importTsv to load data into HBase, but the cluster network may not always be good. Sometimes they face many map tasks inside importTsv throwing InvalidToken exception.

Workaround: Restart the region server.

Kafka file system support

Issue: Encrypted file systems such as SafenetFS are not supported for Kafka. Index file corruption can occur.

Workaround: N/A

For more information, see: Install Kafka.

Spark Streaming Kafka direct API unit test failure in HDP release

Workaround: None.

Cyclic symlink for ranger usersync configuration after upgrade

Issue: When manually upgrading from 2.3.4 to 2.4.0, a cyclic symlink gets created for usersync conf.

Cause: This issue arises due to wrongly created symlinks which make the conf links cyclic and invalid.

Workaround:

After upgrade getting java.lang.NoClassDefFoundError

Issue: java.lang.NoClassDefFoundError error found in ranger usersync log after upgrade.

Workaround: Copy the below jar files into ranger usersync lib folder and restart the service.

cp /usr/hdp/current/hadoop-client/lib/commons-httpclient-3.1.jar /usr/hdp/current/ranger-usersync/lib/
cp /usr/hdp/current/hadoop-client/lib/commons-codec-1.4.jar /usr/hdp/current/ranger-usersync/lib/

Description of Problem: Ranger audit to HDFS fails with TGT errors

Workaround: Currently, there is no known workaround for this issue.

Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

Microsoft has introduced changes in LDAP Signing and LDAP Channel Binding to increase the security for communications between LDAP clients and Active Directory domain controllers. These optional changes will have an impact on how 3rd party products integrate with Active Directory using the LDAP protocol.

Workaround

Disable LDAP Signing and LDAP Channel Binding features in Microsoft Active Directory if they are enabled

For more information on this issue, see the corresponding Knowledge article: TSB-2021 405: Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

WebHDFS clients might send SPNEGO authorization header to remote URL without proper verification. A maliciously crafted request can trigger services to send server credentials to a webhdfs path (ie: webhdfs://…) for capturing the service principal

For more information on this issue, see the corresponding Knowledge article: TSB-2021 406: CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

For more information on this issue, see the corresponding Knowledge article: TSB 2020-434: KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

Corruption of HBase data stored with MOB feature

For more information on this issue, see the corresponding Knowledge article: TSB 2021-465: Corruption of HBase data stored with MOB feature on upgrade from CDH 5 and HDP 2

CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

The Apache Solr ReplicationHandler (normally registered at "/replication" under a Solr core) has a "masterUrl" (also "leaderUrl" alias) parameter. The “masterUrl” parameter is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To help prevent the CVE-2021-27905 SSRF vulnerability, Solr should check these parameters against a similar configuration used for the "shards" parameter.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-497: CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

HBase MOB data loss

HBase tables with the MOB feature enabled may encounter problems which result in data loss.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-512: HBase MOB data loss