PT-2017-15695 · Apache · Apache Hadoop

Published 2017-04-26 · Updated 2022-05-13 · CVE-2017-3162

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.7.0

Description The issue arises from the interaction between HDFS clients and a servlet on the DataNode, which allows browsing the HDFS namespace. A query parameter, specifically the NameNode, is not validated in Apache Hadoop. This lack of validation can lead to potential issues.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-3162

GHSA-PR9X-QMP5-J3RR

Affected Products

Apache Hadoop

References · 10

• https://s.apache.org/k2ss · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3162 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pr9x-qmp5-j3rr · Vendor Advisory
• https://t.me/cvenotify/17046 · Telegram Post
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E · Note
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E · Note
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a@%3Cuser.flink.apache.org%3E · Note
• http://securityfocus.com/bid/98017 · Note
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b@%3Cuser.hadoop.apache.org%3E · Note