CVE-2021-33036

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

Score

CVSS 3.1 8.8 High

Status

Modified - security@apache.org

Published

2022-06-15

Last modified

2024-08-03

Weaknesses

CWE-22, CWE-24, CWE-264

Affected products

• Hadoop (Apache)
• Apache Hadoop (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2022/06/15/2
• https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5
• https://security.netapp.com/advisory/ntap-20220722-0003/