PT-2016-3586 · Apache · Apache Hadoop

Hitesh Shah · Published 2016-04-19 · Updated 2022-05-17 · CVE-2015-1776

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.6.x

Description The issue allows local users to obtain sensitive information by reading a credentials file on disk. This occurs when the Intermediate data encryption feature is enabled, causing Apache Hadoop to store intermediate data generated by a MapReduce job along with the encryption key in the file.

Recommendations For Apache Hadoop version 2.6.x, consider disabling the Intermediate data encryption feature until a proper fix is implemented to securely store encryption keys. Restrict access to the credentials file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-1776

GHSA-G48F-FF5H-5F64

Affected Products

Apache Hadoop

References · 5

• https://osv.dev/vulnerability/GHSA-g48f-ff5h-5f64 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1776 · Security Note
• http://securityfocus.com/bid/83259 · Note
• http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/[e-mail]%3E · Note
• http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E · Note