Fixed issues in Cloudera Data Warehouse on premises 1.5.5 SP3 CHF3

Cloudera Data Warehouse

FQDN validation incorrectly applies 63-char DNS label limit to full domain name, blocking Cloudera Data Warehouse activation

Previously, in Cloudera Data Warehouse, the FQDN validation during environment activation incorrectly enforced a 63-character limit on the entire fully qualified domain name. The 63-character limit per RFC 1035 applies only to individual DNS labels, not to the complete FQDN, which can be up to 253 characters. This caused valid FQDNs longer than 63 characters to be rejected during Cloudera Data Warehouse activation, with no available workaround.

This issue is now resolved. The validation correctly applies the 253-character limit to the full FQDN and the 63-character limit to each individual DNS label, using reusable RFC-compliant validators.

Cloudera Data Explorer (Hue)

CDPD-104785: Arbitrary file read on Data Explorer hosts through the localfile importer feature

Previously, a local file inclusion vulnerability existed on the Data Explorer host type through the localfile importer feature. This occurred because two indexer API endpoints accepted unvalidated paths, allowing unauthorized file reads through the path parameter. This issue is now fixed.

Hive

CDPD-105894: SAML bearer token authentication bypass

Previously, an unauthorized attacker could bypass authentication and impersonate any user when SAML browser profile authentication was enabled for Hive HTTP ports. This occurred because the bearer token signature was not verified.

This issue is now resolved by ensuring that the bearer token signature is properly validated during the authentication process.

Apache Jira: HIVE-29653

Iceberg

There are no fixed issues in this release.

Impala

CDPD-106024: Impala: SAML bearer token authentication is bypassed

Previously, an unauthorized attacker could bypass authentication and impersonate any user when SAML browser profile authentication was enabled for Impala HTTP ports. This occurred because the bearer token signature was not verified.

This issue is now resolved by ensuring that the bearer token signature is properly validated during the authentication process.

Apache Jira: CDPD-106024

Trino

DWX-24070: Unintended injection of default Data Lake configurations blocks creation of external Iceberg and Hive connectors

Previously, in Cloudera Data Warehouse, creating a new Iceberg or Hive connector always automatically injected default Data Lake configurations, such as Ranger policies and Kerberos settings. These default configurations are only required for the default Hive or Iceberg connector created during Virtual Warehouse creation to access the default Data Lake. When creating a connector to an external metastore, such as when using an Iceberg REST catalog or Delta Lake integration, these hardcoded defaults could not be bypassed, preventing the creation of REST-based or external catalog connectors.

This issue is now resolved. Creating custom or external Iceberg and Hive connectors no longer includes default Data Lake configurations, enabling custom metastore and catalog setups.