GHSA-7q56-mp4c-gggg

Suggest an improvement
Source
https://github.com/advisories/GHSA-7q56-mp4c-gggg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7q56-mp4c-gggg/GHSA-7q56-mp4c-gggg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7q56-mp4c-gggg
Aliases
Published
2022-05-17T03:35:31Z
Modified
2023-11-08T03:58:31.207186Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper Access Control in Apache Hadoop
Details

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

Database specific 
{
    "nvd_published_at": "2016-11-29T06:59:00Z",
    "github_reviewed_at": "2022-07-06T19:44:12Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-284"
    ]
}
References

Affected packages

Maven / org.apache.hadoop:hadoop-common

Package

Name
org.apache.hadoop:hadoop-common
View open source insights on deps.dev
Purl
pkg:maven/org.apache.hadoop/hadoop-common

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.0
Fixed
2.6.5

Affected versions

2.*

2.6.0
2.6.1
2.6.2
2.6.3
2.6.4

Database specific 

{
    "last_known_affected_version_range": "<= 2.6.4"
}

Maven / org.apache.hadoop:hadoop-common

Package

Name
org.apache.hadoop:hadoop-common
View open source insights on deps.dev
Purl
pkg:maven/org.apache.hadoop/hadoop-common

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.7.0
Fixed
2.7.3

Affected versions

2.*

2.7.0
2.7.1
2.7.2

Database specific 

{
    "last_known_affected_version_range": "<= 2.7.2"
}