Fixed Issues

Cloudera has learned of a potential security vulnerability in a third-party library called the Apache Commons Collections. This library is used in products distributed and supported by Cloudera (“Cloudera Products”), including Cloudera Director. At this time, no specific attack vector for this vulnerability has been identified as present in Cloudera Products.

The Apache Commons Collections potential security vulnerability is titled “Arbitrary remote code execution with InvokerTransformer” and is tracked by COLLECTIONS-580. MITRE has not issued a CVE, but related CVE-2015-4852 has been filed for the vulnerability. CERT has issued Vulnerability Note #576313 for this issue.

Releases affected: Cloudera Director 1.5.1 and lower, CDH 5.5.0, CDH 5.4.8 and lower, Cloudera Manager 5.5.0, Cloudera Manager 5.4.8 and lower, Cloudera Navigator 2.4.0, and Cloudera Navigator 2.3.8 and lower

Users affected: All

Severity (Low/Medium/High): High

Impact: This potential vulnerability may enable an attacker to execute arbitrary code from a remote machine without requiring authentication.

Immediate action required: Upgrade to Cloudera Director 1.5.2, Cloudera Manager 5.5.1, and CDH 5.5.1.

Serialization for complex nested types has been fixed in the Python API client.

Configuration file parsing has been updated to correctly support quoted configuration keys containing special characters such as colons and periods. This enables the usage of special characters in service and role type configurations, and in instance tag keys.

When using a Cloudera Manager package repository or CDH/parcel repository URL that only specifies the major or minor versions, Cloudera Director may incorrectly use the latest available version when trying to grow a cluster.

Workaround: Use a parcel repository that is specified down to the three-digit maintenance version. This will ensure that Director finds the correct version during cluster growth.

For Cloudera Manager: http://archive.cloudera.com/cm5/redhat/6/x86_64/cm/5.3.3/

For CDH: http://archive.cloudera.com/cdh5/parcels/5.3.3/

Although you can deploy Flume through Cloudera Director, you must start it manually using Cloudera Manager after Cloudera Director bootstraps the cluster.

Workaround: Start Flume manually using Cloudera Manager after Cloudera Director bootstraps the cluster.

Impala daemons attempt to connect over IPv6.

Workaround: Add the following command part of the instance bootstrap script: sysctl -w net.ipv6.conf.all.disable_ipv6=1.

DNS queries occasionally timeout with AWS VPN.

Workaround: Cloudera recommends that you install NSCD (name service cache daemon) on all cluster instances via a bootstrap script. By default Linux does not cache DNS lookups. For more information, see the Linux NSCD man page.

Instance normalization has been improved to ensure time is synchronized by Network Time Protocol (NTP) prior to bootstrapping, which improves cluster reliability and consistency.

Instance drive preparation during the bootstrapping process was slow, especially for instances with many large ephemeral drives. Time required for this process has been reduced.

The d2 instance type d2.4xlarge was incorrectly entered into Cloudera Director as d3.4xlarge in virtualizationmappings.properties. This has been corrected.

Cloudera Director no longer upgrades pre-installed Cloudera Manager packages.

Parcel validation now works when configuring an HTTP proxy for Cloudera Director server, allowing correctly configured parcel repository URLs to be used as expected.

Cloudera Director now sets up parcel repository URLs correctly when a cluster is modified.

Cloudera Director now includes first-class support for new AWS instance types d2 and c4. Cloudera Director can be configured to use additional instance types at any point as they become available in AWS.

Restored the ability to have service level custom configurations. Due to internal refactoring changes, it was no longer possible to override service level configs.

Restored the customBannerText configuration file property, which was removed during the internal refactoring work.

The UI showed a progress bar even when a job had failed.

The help text on the Add Environment page for Role-based keys should refer to AWS Identity and Access Management (IAM), not to AMI.

The eu-central-1 region has been added to the region dropdown on the Add Environment page.

All available gateway roles, including YARN, HDFS, and Spark, should be deployed by default on the instance.

Spark on YARN did not appear in the list of services on the Modify Cluster page.