PT-2022-10193 · Apache · Apache Hadoop

Hideyuki Furue · Published 2022-06-15 · Updated 2022-10-27 · CVE-2021-33036

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.2.0 through 2.10.1 Apache Hadoop versions 3.0.0-alpha1 through 3.1.4 Apache Hadoop versions 3.2.0 through 3.2.2 Apache Hadoop versions 3.3.0 through 3.3.1

Description A user who can escalate to yarn user can possibly run arbitrary commands as root user.

Recommendations For Apache Hadoop versions 2.2.0 through 2.10.1, upgrade to Apache Hadoop 2.10.2 or higher. For Apache Hadoop versions 3.0.0-alpha1 through 3.1.4, upgrade to Apache Hadoop 3.2.3 or higher. For Apache Hadoop versions 3.2.0 through 3.2.2, upgrade to Apache Hadoop 3.2.3 or higher. For Apache Hadoop versions 3.3.0 through 3.3.1, upgrade to Apache Hadoop 3.3.2 or higher.

Fix

Deserialization of Untrusted Data

Path traversal

Weakness Enumeration

CWE-502

CWE-24

CWE-22

CWE-264

Related Identifiers

CVE-2021-33036

GHSA-58JX-F5RF-QGQF

OESA-2022-2016

Affected Products

Apache Hadoop

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2021-33036 · Security Note
• https://osv.dev/vulnerability/GHSA-58jx-f5rf-qgqf · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33036 · Vendor Advisory
• https://lists.apache.org/thread/ctr84rmo3xd2tzqcx2b277c8z692vhl5 · Vendor Advisory
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commit/227d64ab59e8aa6477769b2542ad0cd7a6d855cb · Note
• https://github.com/apache/hadoop/commit/45801fba8b00257ab32c02a7d1a05948ba687a49 · Note
• https://github.com/apache/hadoop/commit/ba041fe6d34215f075e0a7b2078d7273147e14b7 · Note
• http://openwall.com/lists/oss-security/2022/06/15/2 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2016 · Note
• https://security.netapp.com/advisory/ntap-20220722-0003 · Note
• https://t.me/cibsecurity/44501 · Telegram Post