Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2018-11765GHSA-RHH9-CM65-3W54

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication w

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.0.1, 2.9.3, 2.8.6
None on Exploit-DB, Metasploit or GitHub

Summary

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a Apache Hadoop

    Version range not reported

  • org.apache.hadoop:hadoop-mainMaven

    From 3.0.0-alpha2 · fixed in 3.0.1

  • org.apache.hadoop:hadoop-mainMaven

    From 2.9.0 · fixed in 2.9.3

  • org.apache.hadoop:hadoop-mainMaven

    From 2.8.0 · fixed in 2.8.6

References 12

lists.apache.org

security.netapp.com