Search for packages
| purl | pkg:maven/org.apache.hadoop/hadoop-common@2.7.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8009
|
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-gx2c-fvhc-ph4j
Aliases: CVE-2022-26612 |
Path traversal in Hadoop In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility … |
Vulnerable |
|
GHSA-f8vc-wfc8-hxqh
Aliases: CVE-2020-9492 |
Improper Privilege Management in Apache Hadoop In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS … |
Vulnerable |
|
GHSA-rmpj-7c96-mrg8
Aliases: CVE-2021-37404 |
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2 There is a potential heap buffer overflow in Apache Hadoop libhdfs native … |
Vulnerable |
|
GHSA-8wm5-8h9c-47pc
Aliases: CVE-2022-25168 |
Apache Hadoop argument injection vulnerability Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed … |
Vulnerable |
|
GHSA-f5fw-25gw-5m92
Aliases: CVE-2024-23454 |
Apache Hadoop: Temporary File Local Information Disclosure Apache Hadoop’s `RunJar.run()` does not set permissions for temporary directory by default. If … |
Not vulnerable |
|
CVE-2018-8029
|
Privilege escalation A user who can escalate to yarn user can possibly run arbitrary commands as root user. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-25168
|
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-37404
Aliases: GHSA-rmpj-7c96-mrg8 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') There is a potential heap buffer overflow … |
Vulnerable |
|
GHSA-h24p-qwf4-84q8
Aliases: CVE-2017-7669 |
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the … |
Vulnerable Vulnerable |
|
CVE-2018-8009
|
Path Traversal Apache Hadoop is exploitable via the zip slip vulnerability in locations that accept a zip file. |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-15713
|
Information Exposure Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-7q56-mp4c-gggg
Aliases: CVE-2016-5393 |
Improper Access Control in Apache Hadoop In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-mf7c-35mq-75pj
Aliases: CVE-2016-6811 |
Insecure Inherited Permissions in Apache Hadoop In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-8r28-r8cp-g6cp
Aliases: CVE-2016-5001 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop This is an information disclosure vulnerability in Apache Hadoop … |
Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2018-11765
|
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without … |