PT-2022-9679 · Apache · Apache Hadoop

Liu Ximing · Published 2022-08-25 · Updated 2023-02-10 · CVE-2021-25642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.4 Apache Hadoop versions prior to 3.3.4

Description The ZKConfigurationStore, optionally used by CapacityScheduler of Apache Hadoop YARN, deserializes data from ZooKeeper without validation, allowing an attacker with access to ZooKeeper to run arbitrary commands as the YARN user.

Recommendations For versions prior to 2.10.2, upgrade to Apache Hadoop 2.10.2 or later. For versions prior to 3.2.4, upgrade to Apache Hadoop 3.2.4 or later. For versions prior to 3.3.4, upgrade to Apache Hadoop 3.3.4 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-25642

GHSA-RR2M-GFFV-MGRJ

Affected Products

Apache Hadoop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-25642 · Security Note
• https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rr2m-gffv-mgrj · Vendor Advisory
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commit/5e2f4339fadc88f20543915fc9b0aaeaf4f9e7bf · Note
• https://t.me/pentestingnews/27372 · Telegram Post
• https://security.netapp.com/advisory/ntap-20221201-0003 · Note