Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2018-11768GHSA-HX83-RPQF-M267

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupte

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.8.5, 2.9.2, 3.1.1
None on Exploit-DB, Metasploit or GitHub

Summary

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a Apache Hadoop

    Version range not reported

  • org.apache.hadoop:hadoop-mainMaven

    From 2.2.0 · fixed in 2.8.5

  • org.apache.hadoop:hadoop-mainMaven

    From 2.9.0 · fixed in 2.9.2

  • org.apache.hadoop:hadoop-mainMaven

    From 3.0.0 · fixed in 3.1.1

References 10

lists.apache.org