PT-2017-15695 · Apache · Apache Hadoop

Publicado 2017-04-26 · Atualizado 2022-05-13 · CVE-2017-3162

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.7.0

Description The issue arises from the interaction between HDFS clients and a servlet on the DataNode, which allows browsing the HDFS namespace. A query parameter, specifically the NameNode, is not validated in Apache Hadoop. This lack of validation can lead to potential issues.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-3162

GHSA-PR9X-QMP5-J3RR

Produtos afetados

Apache Hadoop

Referências · 10

• https://s.apache.org/k2ss · Aviso do Fabricante
• https://t.me/cvenotify/17046 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-3162 · Nota de Segurança
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2017-3162 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a@%3Cuser.flink.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-pr9x-qmp5-j3rr · Aviso do Fabricante
• http://securityfocus.com/bid/98017 · Nota
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b@%3Cuser.hadoop.apache.org%3E · Nota