CVE-2018-8042

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.

Score

CVSS 3.0 8.1 High

Status

Modified - security@apache.org

Published

2018-07-18

Last modified

2024-09-17

Weaknesses

CWE-209

Affected products

• Ambari (Apache)
• Apache Ambari (Apache Software Foundation)

References

• http://www.securityfocus.com/bid/104869
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-CVE-2018-8042