CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

Score

CVSS 3.0 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2017-03-23

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Hadoop (Apache)
• Cdh (Cloudera)

References

• https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r