rdblue opened a new issue, #16479: URL: https://github.com/apache/iceberg/issues/16479
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution. > > Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them. # Summary Creating a Flink source can auto-create external databases and tables, turning a read path into a write-capable provisioning path. # Affected Maven coordinates * versioned integration artifacts: `org.apache.iceberg:iceberg-flink-1.20`, `org.apache.iceberg:iceberg-flink-2.0`, `org.apache.iceberg:iceberg-flink-2.1` # Attacker prerequisites * ability to call the affected maintenance, DDL, or cleanup path * a deployment where that caller should not be able to target the broader resource set that the current code allows # Impact * A read path has write side effects. * Users who are expected to be able to define or query an Iceberg source can end up provisioning catalog objects as a side effect. * This widens the privilege surface and creates surprising external mutations during planning/setup. # Proof status Source review only. The issue is visible directly from source and the linked review notes. # Key source references * org.apache.iceberg.flink.FlinkDynamicTableFactory Current severity assessment [2]: Moderate [1] https://iceberg.apache.org/security/ [2] https://security.apache.org/blog/severityrating/ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
