PT-2022-3981 · Apache · Apache Hadoop+1

Kostya Kortchinsky · Published 2022-08-04 · Updated 2025-12-30 · CVE-2022-25168

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.4 Apache Hadoop versions prior to 3.3.3

Description The issue is related to the FileUtil.unTar(File, File) API in Apache Hadoop, which does not escape the input file name before being passed to the shell, allowing an attacker to inject arbitrary commands. This API is used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only run by a local user, and in Hadoop 2.x for yarn localization, enabling remote code execution. It is also used in Apache Spark from the SQL command ADD ARCHIVE, but executing shell scripts does not confer new permissions to the caller.

Recommendations To resolve the issue, users should upgrade to Apache Hadoop 2.10.2 or upper. To resolve the issue, users should upgrade to Apache Hadoop 3.2.4 or upper. To resolve the issue, users should upgrade to Apache Hadoop 3.3.3 or upper. As a temporary workaround, consider restricting the use of the FileUtil.unTar(File, File) API until a patch is available. Avoid using the SQL command ADD ARCHIVE in Apache Spark until the issue is resolved.

Fix

RCE

Argument Injection

OS Command Injection

Weakness Enumeration

CWE-88

CWE-78

Related Identifiers

BDU:2022-04814

CVE-2022-25168

GHSA-8WM5-8H9C-47PC

OESA-2022-2092

Affected Products

Apache Hadoop

Apache Spark

References · 15

• https://osv.dev/vulnerability/CVE-2022-25168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37404 · Security Note
• https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2092 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04814 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-26612 · Security Note
• https://osv.dev/vulnerability/GHSA-8wm5-8h9c-47pc · Vendor Advisory
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746 · Note
• https://security.netapp.com/advisory/ntap-20220915-0007 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2092 · Note
• https://t.me/pentestingnews/26553 · Telegram Post
• https://t.me/cibsecurity/47559 · Telegram Post
• https://twitter.com/Loginsoft_Intel/status/2006010019641528664 · Twitter Post