PT-2022-10651 · Apache · Apache Hadoop

Igor Chervatyuk · Published 2022-06-13 · Updated 2023-06-27 · CVE-2021-37404

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.3 Apache Hadoop versions prior to 3.3.2

Description There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. This issue occurs when a file path provided by a user is opened without validation, which may result in a denial of service or arbitrary code execution.

Recommendations For versions prior to 2.10.2, upgrade to Apache Hadoop 2.10.2 or higher. For versions prior to 3.2.3, upgrade to Apache Hadoop 3.2.3 or higher. For versions prior to 3.3.2, upgrade to Apache Hadoop 3.3.2 or higher.

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-131

CWE-787

Related Identifiers

CVE-2021-37404

GHSA-RMPJ-7C96-MRG8

OESA-2022-2092

Affected Products

Apache Hadoop

References · 12

• https://osv.dev/vulnerability/CVE-2021-37404 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37404 · Security Note
• https://osv.dev/vulnerability/GHSA-rmpj-7c96-mrg8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25168 · Security Note
• https://github.com/apache/hadoop · Note
• https://t.me/cvenotify/31997 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220715-0007 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092 · Note
• https://t.me/cibsecurity/44255 · Telegram Post
• https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo · Note