GHSA-7q56-mp4c-gggg
Improper Access Control in Apache Hadoop
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2016-5393
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.hadoop:hadoop-common | introduced 2.6.0, fixed 2.6.5 |
| Maven · org.apache.hadoop:hadoop-common | introduced 2.7.0, fixed 2.7.3 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2016-5393 ADVISORY
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E WEB
- http://www.securityfocus.com/bid/94574 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |