VulnerableCode Package Details - pkg:maven/org.apache.hadoop/hadoop-common@2.8.3

Search for packages

Advisory	Summary	Fixed in package version
CVE-2018-8009	Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable …	2.7.7 Vulnerable 2.8.5 Vulnerable 2.9.2 Vulnerable 2.10.0 Vulnerable 3.1.1 Vulnerable 3.1.2 Vulnerable 3.1.3 Vulnerable 3.2.0 Vulnerable 3.2.1 Vulnerable
CVE-2018-11765	In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without …	2.4.1 Vulnerable 2.6.0 Vulnerable 2.6.4 Vulnerable 2.6.5 Vulnerable 2.7.0 Vulnerable 2.7.1 Vulnerable 2.7.2 Vulnerable 2.7.3 Vulnerable 2.7.4 Vulnerable 2.7.5 Vulnerable 3.1.0 Vulnerable 2.7.7 Vulnerable 2.10.0 Vulnerable 3.1.1 Vulnerable 3.1.2 Vulnerable 3.1.3 Vulnerable 3.2.0 Vulnerable 3.2.1 Vulnerable 2.5.1 Vulnerable 3.3.0 Vulnerable
GHSA-gx2c-fvhc-ph4j Aliases: CVE-2022-26612	Path traversal in Hadoop In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility …	2.10.2 Vulnerable
GHSA-f8vc-wfc8-hxqh Aliases: CVE-2020-9492	Improper Privilege Management in Apache Hadoop In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS …	2.10.1 Vulnerable
GHSA-rmpj-7c96-mrg8 Aliases: CVE-2021-37404	Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2 There is a potential heap buffer overflow in Apache Hadoop libhdfs native …	2.10.2 Vulnerable
GHSA-8wm5-8h9c-47pc Aliases: CVE-2022-25168	Apache Hadoop argument injection vulnerability Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed …	2.10.2 Vulnerable
GHSA-f5fw-25gw-5m92 Aliases: CVE-2024-23454	Apache Hadoop: Temporary File Local Information Disclosure Apache Hadoop’s `RunJar.run()` does not set permissions for temporary directory by default. If …	3.4.0 Not vulnerable
CVE-2018-8029	Privilege escalation A user who can escalate to yarn user can possibly run arbitrary commands as root user.	2.8.5 Vulnerable 2.9.2 Vulnerable 3.1.1 Vulnerable
CVE-2022-25168	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input …	2.10.2 Vulnerable 3.3.3 Vulnerable 3.2.4 Vulnerable
CVE-2021-37404 Aliases: GHSA-rmpj-7c96-mrg8	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') There is a potential heap buffer overflow …	3.2.3 Vulnerable
CVE-2018-8009	Path Traversal Apache Hadoop is exploitable via the zip slip vulnerability in locations that accept a zip file.	2.7.7 Vulnerable 2.8.5 Vulnerable 2.9.2 Vulnerable 3.1.1 Vulnerable 2.7.7 Vulnerable 2.8.5 Vulnerable 2.9.2 Vulnerable 3.1.1 Vulnerable

Advisory

Summary

Fixed in package version

CVE-2018-8009

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable …

2.7.7
Vulnerable

2.8.5
Vulnerable

2.9.2
Vulnerable

2.10.0
Vulnerable

3.1.1
Vulnerable

3.1.2
Vulnerable

3.1.3
Vulnerable

3.2.0
Vulnerable

3.2.1
Vulnerable

CVE-2018-11765

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without …

2.4.1
Vulnerable

2.6.0
Vulnerable

2.6.4
Vulnerable

2.6.5
Vulnerable

2.7.0
Vulnerable

2.7.1
Vulnerable

2.7.2
Vulnerable

2.7.3
Vulnerable

2.7.4
Vulnerable

2.7.5
Vulnerable

3.1.0
Vulnerable

2.7.7
Vulnerable

2.10.0
Vulnerable

3.1.1
Vulnerable

3.1.2
Vulnerable

3.1.3
Vulnerable

3.2.0
Vulnerable

3.2.1
Vulnerable

2.5.1
Vulnerable

3.3.0
Vulnerable

GHSA-gx2c-fvhc-ph4j
Aliases:
CVE-2022-26612

Path traversal in Hadoop In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility …

2.10.2
Vulnerable

GHSA-f8vc-wfc8-hxqh
Aliases:
CVE-2020-9492

Improper Privilege Management in Apache Hadoop In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS …

2.10.1
Vulnerable

GHSA-rmpj-7c96-mrg8
Aliases:
CVE-2021-37404

Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2 There is a potential heap buffer overflow in Apache Hadoop libhdfs native …

2.10.2
Vulnerable

GHSA-8wm5-8h9c-47pc
Aliases:
CVE-2022-25168

Apache Hadoop argument injection vulnerability Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed …

2.10.2
Vulnerable

GHSA-f5fw-25gw-5m92
Aliases:
CVE-2024-23454

Apache Hadoop: Temporary File Local Information Disclosure Apache Hadoop’s `RunJar.run()` does not set permissions for temporary directory by default. If …

3.4.0
Not vulnerable

CVE-2018-8029

Privilege escalation A user who can escalate to yarn user can possibly run arbitrary commands as root user.

2.8.5
Vulnerable

2.9.2
Vulnerable

3.1.1
Vulnerable

CVE-2022-25168

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input …

2.10.2
Vulnerable

3.3.3
Vulnerable

3.2.4
Vulnerable

CVE-2021-37404
Aliases:
GHSA-rmpj-7c96-mrg8

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') There is a potential heap buffer overflow …

3.2.3
Vulnerable

CVE-2018-8009

Path Traversal Apache Hadoop is exploitable via the zip slip vulnerability in locations that accept a zip file.

2.7.7
Vulnerable

2.8.5
Vulnerable

2.9.2
Vulnerable

3.1.1
Vulnerable

2.7.7
Vulnerable

2.8.5
Vulnerable

2.9.2
Vulnerable

3.1.1
Vulnerable

Advisory	Summary	Aliases
CVE-2017-15713	Information Exposure Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the …

Advisory

Summary

Aliases

CVE-2017-15713

Information Exposure Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the …

Next non-vulnerable version	3.4.0
Latest non-vulnerable version	3.4.0
Risk score	4.4