Search for packages
| purl | pkg:maven/org.apache.hadoop/hadoop-main@0.23.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-9wd5-xmya-xug6
Aliases: CVE-2017-3166 GHSA-99qr-9cc9-fv2x |
Incorrect Permission Assignment for Critical Resource In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. |
Affected by 7 other vulnerabilities. |
|
VCID-j858-d38m-vfhc
Aliases: CVE-2018-1296 GHSA-v569-g72v-q434 |
Information Exposure In Apache Hadoop, HDFS exposes extended attribute key/value pairs during `listXAttrs`, verifying only path-level search access to the directory rather than path-level read permission to the referent. |
Affected by 6 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-kt1w-97bw-r7bp
Aliases: CVE-2017-15713 GHSA-3v44-382q-55f4 |
Information Exposure Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the `MapReduce` job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the `MapReduce` job history server host. |
Affected by 7 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-qwzh-r4an-rubv
Aliases: CVE-2012-1574 GHSA-c6f9-4pmv-m7m6 |
Apache Hadoop allows impersonation of arbitrary cluster user accounts The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zjq7-gsc9-y7ep
Aliases: CVE-2012-2945 GHSA-v5c9-98f7-2h54 |
Improper Link Resolution Before File Access ('Link Following') Hadoop 1.0.3 contains a symlink vulnerability. |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||