Filtered by vendor Apache
Subscriptions
Filtered by product Hadoop
Subscriptions
Total
35 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-11766 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user. | ||||
| CVE-2018-11765 | 1 Apache | 1 Hadoop | 2024-11-21 | 7.5 High |
| In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled. | ||||
| CVE-2018-11764 | 1 Apache | 1 Hadoop | 2024-11-21 | 8.8 High |
| Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured. | ||||
| CVE-2017-7669 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. | ||||
| CVE-2017-3166 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file. | ||||
| CVE-2017-3162 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0. | ||||
| CVE-2017-3161 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. | ||||
| CVE-2017-15718 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications. | ||||
| CVE-2017-15713 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host. | ||||
| CVE-2016-6811 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. | ||||
| CVE-2016-5001 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. | ||||
| CVE-2016-3086 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications. | ||||
| CVE-2014-0229 | 2 Apache, Cloudera | 2 Hadoop, Cdh | 2024-11-21 | N/A |
| Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command. | ||||
| CVE-2012-4449 | 1 Apache | 1 Hadoop | 2024-11-21 | N/A |
| Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. | ||||
| CVE-2012-2945 | 1 Apache | 1 Hadoop | 2024-11-21 | 7.5 High |
| Hadoop 1.0.3 contains a symlink vulnerability. | ||||