CVE-2017-7669

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.

Score

CVSS 3.0 7.5 High

Status

Modified - security@apache.org

Published

2017-06-05

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Hadoop (Apache)
• Apache Hadoop (Apache Software Foundation)

References

• http://www.securityfocus.com/bid/98795
• https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%…