[
https://issues.apache.org/jira/browse/KYLIN-6117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123745#comment-18123745
]
ASF subversion and git services commented on KYLIN-6117:
--------------------------------------------------------
Commit 88dd503d0221a07c6b161ee807f5cdcf7378dec0 in kylin's branch
refs/heads/kylin5 from Li Yang
[ https://gitbox.apache.org/repos/asf?p=kylin.git;h=88dd503d02 ]
KYLIN-6117 derive a default broadcast token for zero-config internal RPC
Fall back to a cluster-wide token derived from the shared metadata location
when kylin.server.broadcast-token is not set, so multi-node broadcast and the
internal metadata-backup RPC keep working after an upgrade without extra
configuration. An explicitly configured token still overrides the default.
> Potential path traversal and missing authorization issue in metadata backup
> broadcast
> -------------------------------------------------------------------------------------
>
> Key: KYLIN-6117
> URL: https://issues.apache.org/jira/browse/KYLIN-6117
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Priority: Major
>
> Security issue reported for Apache Kylin 5.0.3. Public tracking issue only;
> technical details are being handled through the ASF security process.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
