PT-2020-8522 · Apache · Apache Hadoop

Jon-Wei · Published 2020-09-30 · Updated 2021-04-30 · CVE-2018-11765

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 2.8.0 through 2.8.5 Apache Hadoop versions 2.9.0 through 2.9.2 Apache Hadoop versions 3.0.0-alpha2 through 3.0.0

Description: The issue allows any user to access certain servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

Recommendations: For Apache Hadoop versions 2.8.0 through 2.8.5, consider enabling SPNEGO through HTTP to mitigate the risk. For Apache Hadoop versions 2.9.0 through 2.9.2, consider enabling SPNEGO through HTTP to mitigate the risk. For Apache Hadoop versions 3.0.0-alpha2 through 3.0.0, consider enabling SPNEGO through HTTP to mitigate the risk.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-11765

GHSA-RHH9-CM65-3W54

Affected Products

Apache Hadoop

References · 25

• https://osv.dev/vulnerability/GHSA-rhh9-cm65-3w54 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11765 · Security Note
• https://lists.apache.org/thread.html/r2c7f899911a04164ed1707083fcd4135f8427e04778c87d83509b0da%40%3Cgeneral.hadoop.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/rb241464d83baa3749b08cd3dabc8dba70a9a9027edcef3b5d4c24ef4%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/reea5eb8622afbfbfca46bc758f79db83d90a3263a906c4d1acba4971%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r17d94d132b207dad221595fd8b8b18628f5f5ec7e3f5be939ecd8928%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rbe25cac0f499374f8ae17a4a44a8404927b56de28d4c41940d82b7a4%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r79b15c5b66c6df175d01d7560adf0cd5c369129b9a161905e0339927@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r74825601e93582167eb7cdc2f764c74c9c6d8006fa90018562fda60f@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf9dfa8b77585c9227db9637552eebb2ab029255a0db4eb76c2b6c4cf@%3Cdev.druid.apache.org%3E · Note
• https://security.netapp.com/advisory/ntap-20201016-0005 · Note
• https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E · Note