PT-2020-8521 · Apache · Apache Hadoop

Daryn Sharp · Published 2020-10-21 · Updated 2022-06-03 · CVE-2018-11764

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 3.0.0-alpha4 through 3.0.0

Description: The web endpoint authentication check in Apache Hadoop is broken, allowing authenticated users to impersonate any user, even if no proxy user is configured.

Recommendations: For Apache Hadoop versions 3.0.0-alpha4 through 3.0.0, consider restricting access to the web endpoint until a fix is available. As a temporary workaround, review and limit user permissions to minimize the risk of impersonation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-11764

GHSA-4FH8-PM7G-PMXQ

Affected Products

Apache Hadoop

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-11764 · Security Note
• https://lists.apache.org/thread.html/r790ad0a049cde713b93589ecfd4dd2766fda0fc6807eedb6cf69f5c1%40%3Cgeneral.hadoop.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11764 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fh8-pm7g-pmxq · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20201103-0003 · Note