# org.apache.hadoop:hadoop-common (Maven) vulnerabilities

12 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.hadoop/hadoop-common

## Advisories (12)

### [CVE-2024-23454](https://cve.now/CVE-2024-23454): Apache Hadoop: Temporary File Local Information Disclosure

- Severity: Medium 6.2
- Published: Sep 25, 2024
- Affected: fixed in 3.4.0.

### [CVE-2022-25168](https://cve.now/CVE-2022-25168): Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar

- Severity: Unrated
- Published: Aug 4, 2022
- Affected: from 2.0.0, fixed in 2.10.2; from 3.0.0-alpha, fixed in 3.2.4; from 3.3.0, fixed in 3.3.3.

### [CVE-2021-37404](https://cve.now/CVE-2021-37404): Heap buffer overflow in libhdfs native library

- Severity: Unrated
- Published: Jun 13, 2022
- Affected: from 3.3.0, fixed in 3.3.2; from 3.0.0, fixed in 3.2.3; fixed in 2.10.2.

### [CVE-2022-26612](https://cve.now/CVE-2022-26612): Arbitrary file write in FileUtil#unpackEntries on Windows

- Severity: Unrated
- Published: Apr 7, 2022
- Affected: from 3.2.0, fixed in 3.2.3; fixed in 2.10.2; from 3.3.0, fixed in 3.3.3.

### [CVE-2020-9492](https://cve.now/CVE-2020-9492): In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header…

- Severity: Unrated
- Published: Jan 26, 2021
- Affected: from 3.2.0, fixed in 3.2.2; from 3.0.0, fixed in 3.1.4; from 2.0.0, fixed in 2.10.1.

### [CVE-2016-5001](https://cve.now/CVE-2016-5001): This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of…

- Severity: Unrated
- Published: Aug 30, 2017
- Affected: fixed in 2.6.4; from 2.7.0, fixed in 2.7.2.

### [CVE-2017-7669](https://cve.now/CVE-2017-7669): In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input…

- Severity: Unrated
- Published: Jun 2, 2017
- Affected: fixed in 2.8.1; from 3.0.0-alpha1, fixed in 3.0.0-alpha3.

### [CVE-2016-6811](https://cve.now/CVE-2016-6811): In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

- Severity: Unrated
- Published: Apr 11, 2017
- Affected: from 2.0.0-alpha, fixed in 2.7.4.

### [CVE-2014-0229](https://cve.now/CVE-2014-0229): Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the…

- Severity: Unrated
- Published: Mar 23, 2017
- Affected: from 0.23.0, fixed in 0.23.11; from 2.0.0, fixed in 2.4.1.

### [CVE-2016-5393](https://cve.now/CVE-2016-5393): In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run…

- Severity: Unrated
- Published: Nov 29, 2016
- Affected: from 2.6.0, fixed in 2.6.5; from 2.7.0, fixed in 2.7.3.

### [CVE-2015-1776](https://cve.now/CVE-2015-1776): Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials…

- Severity: Unrated
- Published: Apr 19, 2016
- Affected: from 2.6.0, fixed in 2.6.5.

### [CVE-2013-2192](https://cve.now/CVE-2013-2192): The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos…

- Severity: Unrated
- Published: Jan 24, 2014
- Affected: from 2.0.0, fixed in 2.0.6-alpha; from 0.23.0, fixed in 0.23.9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.hadoop:hadoop-common
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.