GHSA-h24p-qwf4-84q8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-h24p-qwf4-84q8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h24p-qwf4-84q8/GHSA-h24p-qwf4-84q8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-h24p-qwf4-84q8
- Aliases
- Published
- 2022-05-17T02:41:57Z
- Modified
- 2023-11-08T03:59:26.035253Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation
- Details
-
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.
- Database specific
{ "nvd_published_at": "2017-06-05T01:29:00Z", "github_reviewed_at": "2022-11-22T18:47:34Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-20" ] }- References
Affected packages
Maven / org.apache.hadoop:hadoop-common
Package
- Name
- org.apache.hadoop:hadoop-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.hadoop/hadoop-common
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.8.1
Affected versions
0.*
0.22.0
0.23.1
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
2.*
2.0.0-alpha
2.0.1-alpha
2.0.2-alpha
2.0.3-alpha
2.0.4-alpha
2.0.5-alpha
2.0.6-alpha
2.1.0-beta
2.1.1-beta
2.2.0
2.3.0
2.4.0
2.4.1
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.8.0
Maven / org.apache.hadoop:hadoop-common
Package
- Name
- org.apache.hadoop:hadoop-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.hadoop/hadoop-common