- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 1 medium
- Registry
- Maven Central
Advisories 12
- CVE-2024-23454Medium 6.2
Apache Hadoop: Temporary File Local Information Disclosure
Affected: fixed in 3.4.0.
- CVE-2022-25168Unrated
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
Affected: from 2.0.0, fixed in 2.10.2; from 3.0.0-alpha, fixed in 3.2.4; from 3.3.0, fixed in 3.3.3.
- CVE-2021-37404Unrated
Heap buffer overflow in libhdfs native library
Affected: from 3.3.0, fixed in 3.3.2; from 3.0.0, fixed in 3.2.3; fixed in 2.10.2.
- CVE-2022-26612Unrated
Arbitrary file write in FileUtil#unpackEntries on Windows
Affected: from 3.2.0, fixed in 3.2.3; fixed in 2.10.2; from 3.3.0, fixed in 3.3.3.
- CVE-2020-9492Unrated
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header…
Affected: from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.4; from 2.0.0, fixed in 2.10.1.
- CVE-2016-5001Unrated
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of…
Affected: fixed in 2.6.4; from 2.7.0, fixed in 2.7.2.
- CVE-2017-7669Unrated
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input…
Affected: fixed in 2.8.1; from 3.0.0-alpha1, fixed in 3.0.0-alpha3.
- CVE-2016-6811Unrated
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Affected: from 2.0.0-alpha, fixed in 2.7.4.
- CVE-2014-0229Unrated
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the…
Affected: from 0.23.0, fixed in 0.23.11; from 2.0.0, fixed in 2.4.1.
- CVE-2016-5393Unrated
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run…
Affected: from 2.6.0, fixed in 2.6.5; from 2.7.0, fixed in 2.7.3.
- CVE-2015-1776Unrated
Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials…
Affected: from 2.6.0, fixed in 2.6.5.
- CVE-2013-2192Unrated
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos…
Affected: from 2.0.0, fixed in 2.0.6-alpha; from 0.23.0, fixed in 0.23.9.