Apache Hadoop (Apache Software Foundation) - vulnerabilities (CVEs)

18 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2024-09-25. Vendor: Apache Software Foundation.

CVEs of Apache Hadoop

• CVE-2024-23454 - CVSS 6.2 (medium), 2024-09-25: Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local…
• CVE-2023-26031 - CVSS 7.5 (high), 2023-11-16: Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN…
• CVE-2021-25642 - CVSS 8.8 (high), 2022-08-25: ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An…
• CVE-2022-25168 - CVSS 9.8 (critical), 2022-08-04: Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary…
• CVE-2021-33036 - CVSS 8.8 (high), 2022-06-15: In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary…
• CVE-2021-37404 - CVSS 9.8 (critical), 2022-06-13: There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial…
• CVE-2022-26612 - CVSS 9.8 (critical), 2022-04-07: In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may…
• CVE-2018-1296 - CVSS 7.5 (high), 2019-02-07: In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs,…
• CVE-2018-11766 - CVSS 8.8 (high), 2018-11-27: In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as…
• CVE-2018-8009 - CVSS 8.8 (high), 2018-11-13: Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip…
• CVE-2017-15718 - CVSS 9.8 (critical), 2018-01-24: The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
• CVE-2017-15713 - CVSS 6.5 (medium), 2018-01-19: Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files…
• CVE-2017-3166 - CVSS 7.8 (high), 2017-11-13: In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world…
• CVE-2016-3086 - CVSS 9.8 (critical), 2017-09-05: The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to…
• CVE-2016-5001 - CVSS 5.5 (medium), 2017-08-30: This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user…
• CVE-2017-7669 - CVSS 7.5 (high), 2017-06-05: In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the…
• CVE-2017-3162 - CVSS 7.3 (high), 2017-04-26: HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in…
• CVE-2017-3161 - CVSS 6.1 (medium), 2017-04-26: The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.