Cloudera Docs

Known Issues in Apache Zeppelin

Learn about the known issues in Zeppelin, the impact or changes to the functionality, and the workaround.

TSB 2024-650: Arbitrary file deletion vulnerability in Apache Zeppelin
The improper Input Validation vulnerability in Apache Zeppelin allows an attacker to delete arbitrary files. Using a successful cross-site scripting attack by accessing the logs through API: 
/api/interpreter/setting/..%2Flogs
The logs folder can be deleted from the directory where the current project is located. If the API is changed to /api/interpreter/setting/..%2F..%2Fzeppelin the following setting, the entire Zeppelin application directory can be deleted. The Zeppelin application directory contains every configuration file, Zeppelin main program files, and so on, which are crucial for the proper operations of Zeppelin.
Upstream JIRA: ZEPPELIN-5624
For the latest update on this issue see the corresponding Knowledge article: TSB 2024-650: TSB title
BUG-125263: Zeppelin service move fails on clusters upgraded from HDP3.1.5
Resolve the circular symlink issue on the Zeppelin node by linking the conf directory to a new directory under /etc/zeppelin:
  • # mkdir -p /etc/zeppelin/<version>/0
  • # rm /usr/hdp/<version>/zeppelin/conf
  • # ln -s /etc/zeppelin/<version>/0 /usr/hdp/<version>/zeppelin/conf
Where version is the HDP version. For example, 7.1.x-yyy. Restart the Zeppelin server in Ambari.
CDPD-16845: Zeppelin - Upgrade to Shiro 1.6.0 due to CVE-2020-13933
In the Zeppelin's shiro-ini configuration, set the following properties: invalidRequest.blockBackslash = false invalidRequest.blockSemicolon = false invalidRequest.blockNonAscii = false
CDPD-3090: Due to a configuration typo, functionality involving notebook repositories does not work
Due to a missing closing brace, access to the notebook repositories API is blocked by default.
From the CDP Management Console, go to Cloudera Manager for the cluster running Zeppelin. On the Zeppelin configuration page (Zeppelin service > Configuration), enter shiro urls in the Search field, and then add the missing closing brace to the notebook-repositories URL, as follows:
/api/notebook-repositories/** = authc, roles[{{zeppelin_admin_group}}]

Click Save Changes, and restart the Zeppelin service.

CDPD-2406: Logout button does not work
Clicking the Logout button in the Zeppelin UI logs you out, but then immediately logs you back in using SSO.
Close the browser.
OPSAPS-59802: Zeppelin and Livy roles should be co-located on the same host.
When installing or upgrading to CDP Private Cloud Base, you must co-locate all Zeppelin and Livy roles on the same cluster host due to an issue with certificate generation.