Search for packages
| purl | pkg:maven/org.apache.hadoop/hadoop-client@2.0.1-alpha |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bd9w-c8vm-aaad
Aliases: CVE-2017-3162 GHSA-pr9x-qmp5-j3rr |
Improper Input Validation HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace |
Affected by 0 other vulnerabilities. |
|
VCID-f7g6-qu2x-aaaj
Aliases: CVE-2017-3161 GHSA-qm7f-r83w-3p46 |
Cross-site Scripting The HDFS web UI in Apache Hadoop is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. |
Affected by 0 other vulnerabilities. |
|
VCID-q9y9-d71v-aaag
Aliases: CVE-2014-3627 GHSA-jpmf-8cj2-595g |
CVE-2014-3627 hadoop: file disclosure flaw |
Affected by 2 other vulnerabilities. |
|
VCID-rwtx-j23r-aaaj
Aliases: CVE-2012-4449 GHSA-q46v-cj5v-hvg6 |
Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-rak2-j769-aaan | DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts. |
CVE-2012-3376
GHSA-qmh2-h7r6-gm6q |