PT-2018-5984 · Apache · Apache Hadoop

Publicado 2018-01-19 · Atualizado 2018-12-21 · CVE-2017-15713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 0.23.x, 2.x through 2.7.4, 2.8.x through 2.8.2, 3.0.0-alpha through 3.0.0-beta1

Description: A cluster user can expose private files owned by the user running the MapReduce job history server process by constructing a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.

Recommendations: For Apache Hadoop versions 0.23.x, update to a version later than 0.23.x to resolve the issue. For Apache Hadoop versions 2.x through 2.7.4, update to version 2.7.5 or later. For Apache Hadoop versions 2.8.x through 2.8.2, update to version 2.8.3 or later. For Apache Hadoop versions 3.0.0-alpha through 3.0.0-beta1, update to a version later than 3.0.0-beta1.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-15713

GHSA-3V44-382Q-55F4

Produtos afetados

Apache Hadoop

Referências · 6

• https://github.com/advisories/GHSA-3v44-382q-55f4 · Nota
• https://osv.dev/vulnerability/CVE-2017-15713 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15713 · Nota de Segurança
• https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91@%3Cgeneral.hadoop.apache.org%3E · Nota
• https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91%40%3Cgeneral.hadoop.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-3v44-382q-55f4 · Aviso do Fabricante