Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.hadoop:hadoop-main

13 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13
Registry
Maven Central

Advisories 13

  • Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0.

    Affected: from 3.0.0-alpha4, fixed in 3.0.1; from 3.0.0-beta1, fixed in 3.0.1; from 3.0.0, fixed in 3.0.1.

  • In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication…

    Affected: from 3.0.0-alpha2, fixed in 3.0.1; from 2.9.0, fixed in 2.9.3; from 2.8.0, fixed in 2.8.6.

  • Hadoop 1.0.3 contains a symlink vulnerability.

    Affected: fixed in 1.0.4.

  • In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be…

    Affected: from 2.2.0, fixed in 2.8.5; from 2.9.0, fixed in 2.9.2; from 3.0.0, fixed in 3.1.1.

  • In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run…

    Affected: from 2.2.0, fixed in 2.8.4; from 2.9.0, fixed in 2.9.2; from 3.0.0, fixed in 3.1.1.

  • In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system…

    Affected: from 2.7.5, fixed in 2.7.7; from 2.8.3, fixed in 2.8.5; from 2.9.0, fixed in 2.9.2.

  • In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during…

    Affected: fixed in 2.7.6; from 2.8.0, fixed in 2.8.4; from 2.9.0, fixed in 2.9.1.

  • In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete.

    Affected: from 2.7.4, fixed in 2.7.7.

  • Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the…

    Affected: from 3.1.0, fixed in 3.1.1; from 3.0.0, fixed in 3.0.3; from 2.9.0, fixed in 2.9.2; from 2.8.0, fixed in 2.8.5; fixed in 2.7.7.

  • The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN…

    Affected: from 2.7.3, fixed in 2.7.5.

  • Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to…

    Affected: fixed in 2.7.5; from 2.8.0, fixed in 2.8.3.

  • In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that…

    Affected: fixed in 2.7.3.

  • The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before…

    Affected: from 0.23, fixed in 0.23.2; from 1.0, fixed in 1.0.2.