RussellSpitzer opened a new issue, #17801: URL: https://github.com/apache/iceberg/issues/17801
> After review, this is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution. It is the same general class as #16460 (`S3V4RestSignerClient` process-wide state). Open PR #16524 isolates static `AuthManager` / `HTTP` client state; it does not change the signed-request cache. # Summary `S3V4RestSignerClient` keeps a process-wide signed-request cache keyed only by HTTP method, region, and URI (30s TTL, populated when the signer responds `Cache-Control: private`). A later principal in the same JVM that requests the same URI can receive the first principal’s SigV4 headers without a new sign call. # Affected Maven coordinates * primary shipped client artifact: `org.apache.iceberg:iceberg-aws` * bundle artifact: `org.apache.iceberg:iceberg-aws-bundle` # Attacker prerequisites * a shared process using S3 remote signing with more than one principal or catalog * two sign requests for the same method + region + URI within the cache TTL * signer response that allows caching (`Cache-Control: private`) # Impact * A principal whose signer would refuse the request can still obtain a previously cached signature for that URI * Cross-principal confusion in shared-JVM engines (e.g. a multi-tenant Spark server) # Proof status Source review only. The issue is visible directly from source. # Key source references * `org.apache.iceberg.aws.s3.signer.S3V4RestSignerClient` (`SIGNED_COMPONENT_CACHE`, cache key) # Related * #16460 — static auth/HTTP fields (same class of bug) * #16524 — fix for #16460; does not address this cache -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
