Learn about the known issues in HBase, the impact or changes to the functionality, and
the workaround.
Known issues identified in Cloudera Runtime 7.3.2.20000 SP2
- Client-side TLS hostname validation issue in Apache Thrift
(libthrift)
- 7.3.2.20000
- A TLS hostname validation issue exists in libthrift versions
lower than 0.23.0. The issue does not allow remote compromise of your CDP HBase server,
but external client applications that connect to the HBase Thrift gateway over TLS might
be vulnerable to Man-in-the-Middle (MitM) traffic interception if an attacker redirects
network traffic.
- Update libthrift to 0.23.0 or higher versions in your
client applications. Version 0.23.0 is fully wire-compatible with the CDP HBase Thrift
server. If an immediate client library update is not possible, perform one of the
following actions:
- Enforce Kerberos (SASL) authentication on the HBase Thrift gateway by using
Cloudera Manager.
- Configure client socket settings to explicitly perform TLS hostname
verification.
For more information, see CVE-2026-43869.
Known issues identified in Cloudera Runtime 7.3.2.10000 SP1
- HBase replication between TLS-enabled Cloudera Operational Database clusters fails due to hostname verification
- 7.3.2.10000
- When you set up reverse HBase replication between two
TLS-enabled Cloudera Operational Database clusters, replication fails if reverse
DNS resolution is not configured between the clusters. During mutual TLS (mTLS)
authentication, the source cluster sends its certificate, which contains the hostname.
The target cluster validates the certificate against its truststore and then verifies
that the client connection IP address matches the hostname in the certificate. Because
reverse DNS resolution does not work between separate Cloudera Operational Database clusters by default, this verification check fails and the connection is
rejected.
This issue occurs when all of the following conditions are true:
- Both clusters have TLS enabled.
- Hostname verification is enabled
(
hbase.client.netty.tls.verify.server.hostname and
hbase.server.netty.tls.verify.client.hostname are set to
true).
hbase.server.netty.tls.client.auth.mode is set to
WANT or NEED.- TLS certificates are issued without an IP Subject Alternative Name (SAN).
- Reverse DNS resolution is not configured between the clusters.
- Mutual TLS trust is established between the clusters.
These are the default settings for a fresh installation of Cloudera Runtime 7.3.2.10000.
- To bypass the client hostname verification check, add the
hbase.server.netty.tls.verify.client.hostname = false property to the
HBase Service Advanced Configuration Snippet (Safety Valve) for
hbase-site.xml using Cloudera Manager.
Known issues identified in Cloudera Runtime 7.3.2.100 CHF 1
There are no new known issues in this release.
Known issues identified before Cloudera Runtime 7.3.2
There are no known issues carried forward that affect HBase in Cloudera Runtime 7.3.2.
