Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.hadoop/hadoop-common@3.0.0-alpha1
purl pkg:maven/org.apache.hadoop/hadoop-common@3.0.0-alpha1
Next non-vulnerable version 3.4.0
Latest non-vulnerable version 3.4.0
Risk score 4.4
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
GHSA-8wm5-8h9c-47pc
Aliases:
CVE-2022-25168
Apache Hadoop argument injection vulnerability Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed …
3.2.4
Vulnerable
GHSA-f5fw-25gw-5m92
Aliases:
CVE-2024-23454
Apache Hadoop: Temporary File Local Information Disclosure Apache Hadoop’s `RunJar.run()` does not set permissions for temporary directory by default. If …
3.4.0
Not vulnerable
CVE-2018-8029

Privilege escalation A user who can escalate to yarn user can possibly run arbitrary commands as root user.
2.8.5
Vulnerable
2.9.2
Vulnerable
3.1.1
Vulnerable
GHSA-h24p-qwf4-84q8
Aliases:
CVE-2017-7669
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the …
3.0.0-alpha3
Vulnerable
3.0.0-alpha3
Vulnerable
This package is not known to fix any advisories.