Search for packages
Package details: pkg:maven/org.apache.hadoop/hadoop-main@3.3.3
purl pkg:maven/org.apache.hadoop/hadoop-main@3.3.3
Next non-vulnerable version 3.3.5
Latest non-vulnerable version 3.3.5
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-yn3b-vn6g-aaaq
Aliases:
CVE-2023-26031
GHSA-94jh-j374-9r3j
hadoop-yarn-server-nodemanager: Untrusted search path may lead to privilege escalation via container-executor suid binary
3.3.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-dcdx-yb8v-aaah Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136). CVE-2022-25168
GHSA-8wm5-8h9c-47pc

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-20T16:48:08.233358+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 36.1.3
2025-06-20T16:01:16.880446+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 36.1.3
2025-06-20T16:01:14.781824+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 36.1.3
2025-06-03T23:25:47.362141+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 36.1.0
2025-06-03T22:41:40.622507+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 36.1.0
2025-06-03T22:41:38.770137+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 36.1.0
2025-06-02T23:23:20.569854+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 36.1.2
2025-06-02T22:30:30.203111+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 36.1.2
2025-06-02T22:30:28.148150+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 36.1.2
2025-04-03T21:45:36.080410+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 36.0.0
2025-04-03T20:12:00.170539+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 36.0.0
2025-04-03T20:11:55.691337+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 36.0.0
2025-02-18T00:52:08.628802+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 35.1.0
2025-02-18T00:38:12.406933+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 35.1.0
2025-02-18T00:38:11.377215+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 35.1.0
2024-11-20T23:21:36.275151+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 35.0.0
2024-11-20T23:16:31.666414+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 35.0.0
2024-11-18T23:09:15.095763+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.3.2
2024-11-18T23:04:03.585859+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.3.2
2024-10-08T00:08:30.700842+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.0.2
2024-10-08T00:03:16.840864+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.0.2
2024-09-23T00:21:57.092400+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.0.1
2024-09-17T22:41:12.094233+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.0.1
2024-04-24T02:36:56.594635+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.0.0rc4
2024-04-24T02:25:35.569643+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.0.0rc4
2024-04-24T02:25:34.752867+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 34.0.0rc4
2024-01-10T05:12:18.940666+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.0.0rc2
2024-01-10T05:00:34.914270+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.0.0rc2
2024-01-10T05:00:34.120252+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 34.0.0rc2
2024-01-03T22:00:03.077059+00:00 GitLab Importer Affected by VCID-yn3b-vn6g-aaaq https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2023-26031.yml 34.0.0rc1
2024-01-03T21:48:22.289918+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah None 34.0.0rc1
2024-01-03T18:03:32.897925+00:00 GitLab Importer Fixing VCID-dcdx-yb8v-aaah https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.hadoop/hadoop-main/CVE-2022-25168.yml 34.0.0rc1