Status dashboard

Last updated on: December 2nd, 2022 at 1:30PM EST

Title: MI-20221129-2 - Mitigated: Edge Connectivity Issues / Degradation

You may be experiencing connectivity issues with Edge sources at this time. We’ve identified the issue and have a workaround available for you to deploy. Please contact Collibra Support by opening a case and our support team will work with you to resolve the issue.

Regions Affected: All
Deployments Affected: Selected Recently Migrated Deployments
CSP: All
Symptom(s): Edge capability degradation or unavailability.
Incident Start Time: Nov 23, 2022
Incident End Time: 12:00 Noon ET Nov 29, 2022

Recommendations:

• Collibra has provided a workaround to resolve this issue
• Click this link for further instructions on deploying the fix
• Open a Support ticket with your Edge installation details if you require further assistance

There is currently no impact to the overall platform (CDIC/DGC).

Last updated on: November 28th, 2022 at 3:00 PM EST

Apache Shiro Authentication Bypass Vulnerability (CVE-2022-40664)

Apache recently issued a security notice disclosing an identity authentication bypass vulnerability (CVE-2022-40664) in Apache Shiro versions earlier than 1.10.0.

Apache Shiro could allow a remote attacker to bypass security restrictions when forwarding or including via RequestDispatcher. A remote attacker can send a specially crafted HTTP request to bypass the authentication process and gain unauthorized access to the application.

Collibra does not use forwarding or including via RequestDispatcher in its source code, and is therefore not vulnerable to this issue.

Whilst Collibra are not using the vulnerable functionality in its products, Collibra in any case plans to upgrade Apache Shiro to a non-vulnerable version in a Collibra release during Q1 2023.

Last updated on: June 10th, 2022 at 3:30 PM EST

AWS Service Degradation within the US-EAST-1 Region

AWS notified Collibra of a period of service degradation between 18:01PM PDT and 21:25PM PDT on 6/9/22 impacting only AWS service APIs in the US-EAST-1 region. Collibra Cloud Operations did not detect service degradation on Collibra environments in this region during that timeframe. However, if you believe your environment was impacted, please open a Support ticket referencing this incident for further follow-up.

This is the AWS communication that CloudOps received - which is publicly available: 6:01 PM PDT on 6/9/22, we experienced elevated error rates and latencies for AWS services within the US-EAST-1 Region. The issue affected AWS service APIs, with no impact to data plane services such as EC2 instances, EBS volumes, or Elastic Load Balancers. We started to see recovery at 7:55 PM PDT and were fully recovered by 9:25 PM PDT. The issue has been resolved and the service is operating normally.

Last updated on: April 8th, 2022 at 5:00 PM EST

Spring4Shell Vulnerabilities

Collibra is committed to ensuring transparency and trust. To that end, we proactively monitor and respond to threats that might impact our products and services.

Collibra is aware of the vulnerabilities involving, Spring4Shell, comprised of CVE-2022-22965 and CVE-2022-22963. CVE-2022-22965 involves vulnerabilities impacting Spring WebMVC and Spring WebFlux applications running on Java 9 and later and exposes the applications to the possibility of remote code execution (RCE). CVE-2022-22963 impacts the Spring Expression Language (SpEL) and can expose applications to the possibility of remote code execution (RCE).

We are continuously monitoring and evaluating these vulnerabilities.

Summary of impact for Collibra

Based on initial review of Collibra products, the impact assessment is as follows:

Collibra Proprietary Software