Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.hadoop:hadoop-client

5 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5
Registry
Maven Central

Advisories 5

  • Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security…

    Affected: fixed in 0.23.4; from 1.0.0, fixed in 1.0.4; from 2.0.0, fixed in 2.0.2.

  • HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace.

    Affected: fixed in 2.7.0.

  • The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.

    Affected: fixed in 2.7.0.

  • The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows…

    Affected: from 0.23.0, fixed in 1.0.1; from 2.0.0, fixed in 2.5.2.

  • DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out…

    Affected: from 2.0.0-alpha, fixed in 2.0.1-alpha.