Search for packages
| purl | pkg:maven/org.apache.hadoop/hadoop-main@0.23.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-48d9-7sfj-zfh3
Aliases: CVE-2018-1296 GHSA-v569-g72v-q434 |
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. |
Affected by 7 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-awsq-a54z-a7am
Aliases: CVE-2012-2945 GHSA-v5c9-98f7-2h54 |
Hadoop symlink vulnerability Hadoop 1.0.3 contains a symlink vulnerability as a result of storing pid files in the shared `/tmp` directory by default. |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-bvc6-q3ey-p7ed
Aliases: CVE-2017-3166 GHSA-99qr-9cc9-fv2x |
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. |
Affected by 8 other vulnerabilities. |
|
VCID-fhzp-w161-nua6
Aliases: CVE-2018-8009 GHSA-6x48-j4x4-cqw3 |
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file. |
Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-x1em-rq9s-s7ae
Aliases: CVE-2017-15713 GHSA-3v44-382q-55f4 |
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host. |
Affected by 8 other vulnerabilities. Affected by 7 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-xx1y-etyu-zfhv | Apache Hadoop allows impersonation of arbitrary cluster user accounts The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. |
CVE-2012-1574
GHSA-c6f9-4pmv-m7m6 |