PT-2021-11768 · Apache · Apache Oozie

Published 2021-03-09 · Updated 2021-03-12 · CVE-2020-35451

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Oozie versions prior to 5.2.1

Description: The issue is related to a race condition in OozieSharelibCLI in Apache Oozie. This condition allows a malicious attacker to replace the files in Oozie's sharelib during its creation.

Recommendations: For versions prior to 5.2.1, update to version 5.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the sharelib creation process to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

CWE-377

Related Identifiers

CVE-2020-35451

Affected Products

Apache Oozie

References · 6

• https://osv.dev/vulnerability/CVE-2020-35451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35451 · Security Note
• https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E · Vendor Advisory
• https://t.me/cvenotify/11279 · Telegram Post
• http://openwall.com/lists/oss-security/2021/03/09/2 · Note
• https://t.me/cibsecurity/24607 · Telegram Post