PT-2018-5984 · Apache · Apache Hadoop

Published 2018-01-19 · Updated 2018-12-21 · CVE-2017-15713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 0.23.x, 2.x through 2.7.4, 2.8.x through 2.8.2, 3.0.0-alpha through 3.0.0-beta1

Description: A cluster user can expose private files owned by the user running the MapReduce job history server process by constructing a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.

Recommendations: For Apache Hadoop versions 0.23.x, update to a version later than 0.23.x to resolve the issue. For Apache Hadoop versions 2.x through 2.7.4, update to version 2.7.5 or later. For Apache Hadoop versions 2.8.x through 2.8.2, update to version 2.8.3 or later. For Apache Hadoop versions 3.0.0-alpha through 3.0.0-beta1, update to a version later than 3.0.0-beta1.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-15713

GHSA-3V44-382Q-55F4

Affected Products

Apache Hadoop

References · 6

• https://osv.dev/vulnerability/CVE-2017-15713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15713 · Security Note
• https://osv.dev/vulnerability/GHSA-3v44-382q-55f4 · Vendor Advisory
• https://github.com/advisories/GHSA-3v44-382q-55f4 · Note
• https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91@%3Cgeneral.hadoop.apache.org%3E · Note
• https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91%40%3Cgeneral.hadoop.apache.org%3E · Note