GHSA-f8vc-wfc8-hxqh

Source

https://github.com/advisories/GHSA-f8vc-wfc8-hxqh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-f8vc-wfc8-hxqh/GHSA-f8vc-wfc8-hxqh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f8vc-wfc8-hxqh

Aliases

Published

2022-02-09T22:17:38Z

Modified

2024-03-08T05:20:12.847694Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Privilege Management in Apache Hadoop

Details

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.

Database specific

{
    "nvd_published_at": "2021-01-26T18:16:00Z",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-06T18:29:12Z"
}

References

Affected packages

Maven / org.apache.hadoop:hadoop-common

Package

Name: org.apache.hadoop:hadoop-common; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2.0

Fixed

3.2.2

Affected versions

3.*

3.2.0

3.2.1

Maven / org.apache.hadoop:hadoop-common

Package

Name: org.apache.hadoop:hadoop-common; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.4

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.1.3

Maven / org.apache.hadoop:hadoop-common

Package

Name: org.apache.hadoop:hadoop-common; View open source insights on deps.dev
Purl: pkg:maven/org.apache.hadoop/hadoop-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.10.1

Affected versions

2.*

2.0.1-alpha

2.0.2-alpha

2.0.3-alpha

2.0.4-alpha

2.0.5-alpha

2.0.6-alpha

2.1.0-beta

2.1.1-beta

2.2.0

2.3.0

2.4.0

2.4.1

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.9.0

2.9.1

2.9.2

2.10.0