# org.apache.hadoop:hadoop-main (Maven) vulnerabilities 13 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.apache.hadoop/hadoop-main ## Advisories (13) ### [CVE-2018-11764](https://cve.now/CVE-2018-11764): Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. - Severity: Unrated - Published: Oct 21, 2020 - Affected: from 3.0.0-alpha4, fixed in 3.0.1; from 3.0.0-beta1, fixed in 3.0.1; from 3.0.0, fixed in 3.0.1. ### [CVE-2018-11765](https://cve.now/CVE-2018-11765): In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication… - Severity: Unrated - Published: Sep 30, 2020 - Affected: from 3.0.0-alpha2, fixed in 3.0.1; from 2.9.0, fixed in 2.9.3; from 2.8.0, fixed in 2.8.6. ### [CVE-2012-2945](https://cve.now/CVE-2012-2945): Hadoop 1.0.3 contains a symlink vulnerability. - Severity: Unrated - Published: Oct 28, 2019 - Affected: fixed in 1.0.4. ### [CVE-2018-11768](https://cve.now/CVE-2018-11768): In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be… - Severity: Unrated - Published: Oct 4, 2019 - Affected: from 2.2.0, fixed in 2.8.5; from 2.9.0, fixed in 2.9.2; from 3.0.0, fixed in 3.1.1. ### [CVE-2018-8029](https://cve.now/CVE-2018-8029): In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run… - Severity: Unrated - Published: May 30, 2019 - Affected: from 2.2.0, fixed in 2.8.4; from 2.9.0, fixed in 2.9.2; from 3.0.0, fixed in 3.1.1. ### [CVE-2018-11767](https://cve.now/CVE-2018-11767): In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system… - Severity: Unrated - Published: Mar 18, 2019 - Affected: from 2.7.5, fixed in 2.7.7; from 2.8.3, fixed in 2.8.5; from 2.9.0, fixed in 2.9.2. ### [CVE-2018-1296](https://cve.now/CVE-2018-1296): In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during… - Severity: Unrated - Published: Feb 7, 2019 - Affected: fixed in 2.7.6; from 2.8.0, fixed in 2.8.4; from 2.9.0, fixed in 2.9.1. ### [CVE-2018-11766](https://cve.now/CVE-2018-11766): In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. - Severity: Unrated - Published: Nov 27, 2018 - Affected: from 2.7.4, fixed in 2.7.7. ### [CVE-2018-8009](https://cve.now/CVE-2018-8009): Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the… - Severity: Unrated - Published: Nov 13, 2018 - Affected: from 3.1.0, fixed in 3.1.1; from 3.0.0, fixed in 3.0.3; from 2.9.0, fixed in 2.9.2; from 2.8.0, fixed in 2.8.5; fixed in 2.7.7. ### [CVE-2017-15718](https://cve.now/CVE-2017-15718): The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN… - Severity: Unrated - Published: Jan 24, 2018 - Affected: from 2.7.3, fixed in 2.7.5. ### [CVE-2017-15713](https://cve.now/CVE-2017-15713): Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to… - Severity: Unrated - Published: Jan 19, 2018 - Affected: fixed in 2.7.5; from 2.8.0, fixed in 2.8.3. ### [CVE-2017-3166](https://cve.now/CVE-2017-3166): In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that… - Severity: Unrated - Published: Nov 13, 2017 - Affected: fixed in 2.7.3. ### [CVE-2012-1574](https://cve.now/CVE-2012-1574): The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before… - Severity: Unrated - Published: Apr 12, 2012 - Affected: from 0.23, fixed in 0.23.2; from 1.0, fixed in 1.0.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.hadoop:hadoop-main Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.