PT-2021-12856 · Apache · Apache Hadoop

Published 2021-01-26 · Updated 2024-03-06 · CVE-2020-9492

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 2.0.0-alpha through 2.10.0 Apache Hadoop versions 3.0.0-alpha1 through 3.1.3 Apache Hadoop versions 3.2.0 through 3.2.1

Description: The WebHDFS client in Apache Hadoop might send an SPNEGO authorization header to a remote URL without proper verification.

Recommendations: For Apache Hadoop versions 2.0.0-alpha through 2.10.0, update to a version outside of this range to resolve the issue. For Apache Hadoop versions 3.0.0-alpha1 through 3.1.3, update to a version outside of this range to resolve the issue. For Apache Hadoop versions 3.2.0 through 3.2.1, update to a version outside of this range to resolve the issue.

Fix

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

BIT-SOLR-2020-9492

CVE-2020-9492

GHSA-F8VC-WFC8-HXQH

OESA-2021-1201

Affected Products

Apache Hadoop

References · 41

• https://osv.dev/vulnerability/OESA-2021-1201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9492 · Security Note
• https://osv.dev/vulnerability/GHSA-f8vc-wfc8-hxqh · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2020-9492 · Vendor Advisory
• https://lists.apache.org/thread.html/r513758942356ccd0d14538ba18a09903fc72716d74be1cb727ea91ff%40%3Cgeneral.hadoop.apache.org%3E · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commit/ca65409836d2949e9a9408d40bec0177b414cd5d · Note
• https://t.me/cvenotify/10861 · Telegram Post
• https://lists.apache.org/thread.html/r6c2fa7949738e9d39606f1d7cd890c93a2633e3357c9aeaf886ea9a6%40%3Cissues.solr.apache.org%3E · Note
• https://lists.apache.org/thread.html/r79323adac584edab99fd5e4b52a013844b784a5d4b600da0662b33d6%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r941e9be04efe0f455d20aeac88516c0848decd7e7b1d93d5687060f4@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/rca4516b00b55b347905df45e5d0432186248223f30497db87aba8710@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/r79201a209df9a4e7f761e537434131b4e39eabec4369a7d668904df4@%3Cissues.solr.apache.org%3E · Note