Cloudera Docs

Fixed issues in Cloudera Runtime 7.1.9 SP2 CHF 4

Know more about the cumulative hotfix 4 for 7.1.9 SP2. This cumulative hotfix was released on September 22, 2026.

Following are the list of fixes that were shipped for CDP Private Cloud Base version 7.1.9-1.cdh7.1.9.p20400.83220857.

CDPD-98147: Orphaned SST files in the backup directory were not cleaned up after an Ozone Manager crash
Previously, SST files created in the SST backup directory during the compactionBegin phase were orphaned if the compaction process was terminated prematurely due to an Ozone Manager (OM) crash or restart. These orphaned files were not automatically cleaned up, which led to unnecessary storage consumption. This issue is now resolved.

Apache Jira: HDDS-14742

CDPD-109489: Snapshot defragmentation fails when directly ingesting a single live RocksDB SST file
Previously, incremental snapshot defragmentation could directly ingest a live RocksDB SST file when a table had exactly one candidate SST and the snapshot version was greater than zero. This could cause ingestion failures, such as External file version not found, or incorrect snapshot contents because the shortcut bypassed bucket filtering, comparisons between snapshots, and deletion-marker generation. Ozone now rewrites candidate SSTs into an external SST containing the required bucket-level changes before ingestion, including when there is only one candidate file.

Apache Jira: HDDS-15860

CDPD-119543: Atlas UI renders ENUM-typed entity attributes as dropdowns in Create/Edit Entity form
Previously, when creating or editing a custom entity with attributes of an ENUM type, the Atlas UI rendered a freeform text input instead of a dropdown populated with the allowed values of the enum.
This issue is now fixed. When creating or editing a custom entity of ENUM type, a dropdown menu is provided for option selection instead of a standard text input field.

Apache Jira: ATLAS-5371

CDPD-119506: Atlas Beta UI fails to load when switched from the Classic UI
When you switched from the Atlas Classic UI to the Beta UI, the Beta UI did not load and displayed a Something went wrong message on a loading spinner. API requests from the Beta UI failed with HTTP 404 errors because they were sent to an incorrect endpoint path.
This issue is now fixed. The Atlas Beta UI loads properly.
CDPD-98910: Hive queries fail with NullPointerException when debug logging is enabled
When debug logging was enabled in HiveServer2 (HS2) for tag-based Ranger policies, Hive queries failed with a NullPointerException if no resource evaluators were found. This issue has been resolved by adding proper null handling in the Ranger tag enricher, allowing queries to execute normally in debug mode.
CDPD-90754: Unencoded characters in Hue API responses
Previously, Hue API’s raw responses included HTML special characters (<, >, &) without encoding. Because these responses are served with Content-Type: application/json, browsers parse them as JSON rather than HTML, so this behavior was not directly exploitable as Cross-Site Scripting (XSS). However, automated security scanners flag the presence of these raw characters as a potential XSS finding. To clear these findings and provide an additional layer of protection (defense in depth), Hue now encodes raw API responses so that HTML special characters are escaped into their Unicode sequences. This issue is now fixed.
CDPD-67103: Rename should not be allowed on a table having row filter or column masking policy
Previously, renaming a table or column with an active row filter or column masking policy was allowed, which caused the existing policies to become invalid for the renamed table. With this fix, ALTER TABLE rename operations are blocked when the source table has an active row filter or column masking policy, ensuring that security policies remain consistently enforced.
CDPD-102464: ZooKeeper configuration properties logged without redaction
Previously, ZooKeeper configuration properties were recorded in plain text, potentially exposing sensitive data within the logs.

This issue is now resolved by implementing a log redaction method to ensure that all sensitive values are appropriately masked during the logging process.

CDPD-102463: Reverse DNS lookup in TLS client and server
Previously, ZooKeeper performed reverse DNS lookups during TLS handshakes in both the client and server, which introduced a high security vulnerability.

This issue is now resolved. Reverse DNS lookup is now disabled in the ZooKeeper TLS client and server.

Apache Jira - ZOOKEEPER-4986

Common Vulnerabilities and Exposures (CVE) that is fixed in this CHF: